BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-24

Assigner: SolarWinds

Description

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-11-24

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40545

EUVD

EUVD-2025-197926

Affected Vendors & Products

Vendor	Product	Version / Range
solarwinds	observability_self-hosted	to 2025.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an open redirection issue in SolarWinds Observability Self-Hosted. The software does not properly sanitize URLs, allowing an attacker to manipulate the URL string to redirect users to malicious websites. Exploiting this requires high attack complexity and user authentication.

Impact Analysis

An attacker could use this vulnerability to redirect authenticated users to malicious sites, potentially leading to phishing attacks or other malicious activities. Although the attack complexity is high and authentication is required, successful exploitation could compromise user trust and security.

Hi! I’m here to help you understand CVE-2025-40545. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70