Weaknesses of type CWE-601

1,185 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2025-32970MEDIUMorg.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerabilityEPSS 0.6%CVE-2024-28239MEDIUMURL Redirection to Untrusted Site in OAuth2/OpenID in directusEPSS 0.6%CVE-2010-4266—It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.EPSS 0.6%CVE-2021-23052—On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IPEPSS 0.6%CVE-2024-46331HIGHModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability alEPSS 0.6%CVE-2024-7260MEDIUMKeycloak-core: open redirect on account pageEPSS 0.6%CVE-2024-10812MEDIUMOpen Redirect in binary-husky/gpt_academicEPSS 0.6%CVE-2024-34074MEDIUMFrappe vuilnerable to an open redirect on login pageEPSS 0.6%CVE-2021-44054MEDIUMOpen redirectEPSS 0.6%CVE-2021-22141MEDIUMAn open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could EPSS 0.6%CVE-2025-55207MEDIUM@astrojs/node's trailing slash handling causes open redirect issueEPSS 0.6%CVE-2022-25799—An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0EPSS 0.6%CVE-2021-3851MEDIUMOpen Redirect in firefly-iii/firefly-iiiEPSS 0.6%CVE-2021-38678MEDIUMOpen Redirect Vulnerability in QcalAgentEPSS 0.6%CVE-2024-42353MEDIUMWebOb's location header normalization during redirect leads to open redirectEPSS 0.6%CVE-2021-1218MEDIUMCisco Smart Software Manager Satellite Open Redirect VulnerabilityEPSS 0.6%CVE-2024-24034MEDIUMSetor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary EPSS 0.6%CVE-2025-23363MEDIUMA vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V1EPSS 0.6%CVE-2025-65717MEDIUMAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML pEPSS 0.6%CVE-2022-3280LOWAn open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an EPSS 0.6%