Logo Cloud CVE-2025-0608
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing.
This issue affects Logo Cloud: before 2025.R6.
AnalysisAI
Open redirect in Logo Cloud before version 2025.R6 enables phishing and forceful browsing attacks against authenticated users who click attacker-crafted URLs. The CVSS vector (PR:L/UI:R) confirms the attacker requires low-privilege access and victim interaction, making this a social-engineering-dependent vulnerability. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating negligible opportunistic exploitation activity at time of analysis.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) describes a class of vulnerability where an application accepts a user-controlled URL parameter and redirects the browser to it without validating the destination against an allowlist of trusted domains. Logo Cloud, a cloud-hosted business application by Logo Software Inc., fails to sanitize redirect targets, enabling an attacker to construct a legitimate-looking Logo Cloud URL that transparently forwards victims to an arbitrary external site. The advisory additionally tags 'Forceful Browsing', indicating the redirect mechanism may also be abused to bypass navigation controls or access restricted internal paths depending on application context. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U reflects network reachability with low complexity, requiring a low-privileged account (or a session context on the victim side) and deliberate user click action.
Affected ProductsAI
Logo Cloud by Logo Software Inc. is affected in all releases prior to version 2025.R6. No CPE string was provided in the NVD entry at time of analysis. The advisory was published by the Turkish National Cyber Incident Response Center (USOM/TR-CERT) and is available at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0318 and https://www.usom.gov.tr/bildirim/tr-25-0318. No additional platforms, operating systems, or deployment variants are enumerated in available data.
RemediationAI
Upgrade Logo Cloud to version 2025.R6 or later, which is the vendor-confirmed fix per the USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0318. If immediate upgrade is not feasible, compensating controls should focus on the delivery vector: configure email security gateways to flag or rewrite outbound Logo Cloud URLs containing external redirect parameters, and train users to inspect URLs before clicking links that originate from the application. Web application firewalls can be configured to block requests containing redirect parameters pointing to off-domain destinations, though this may interfere with legitimate SSO or deep-link functionality - test in staging before deploying. Restricting the platform to trusted networks via IP allowlisting reduces the attacker's ability to deliver the crafted URL to unauthenticated external parties, though it does not address insider-sent phishing links.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today