Weaknesses of type CWE-601

1,185 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2022-3280LOWAn open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an EPSS 0.6%CVE-2026-52802MEDIUMGogs: Open Redirect via redirect_to in GogsEPSS 0.6%CVE-2022-30992—Open redirect via user-controlled query parameterEPSS 0.6%CVE-2024-50345LOWOpen redirect via browser-sanitized URLs in symfony/http-foundationEPSS 0.6%CVE-2015-10104LOWIcons for Features Plugin class-icons-for-features-admin.php redirectEPSS 0.6%CVE-2024-5492MEDIUMOpen redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websitesEPSS 0.6%CVE-2022-3438MEDIUMOpen Redirect in ikus060/rdiffwebEPSS 0.5%CVE-2024-2465HIGHOpen redirection in CDeXEPSS 0.5%CVE-2022-38197MEDIUMBUG-000148347 Unvalidated redirect issues in ArcGIS Server.EPSS 0.5%CVE-2024-24808MEDIUMpyLoad open redirect vulnerability due to improper validation of the is_safe_url functionEPSS 0.5%CVE-2022-46683MEDIUMJenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing EPSS 0.5%CVE-2022-31735—OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an EPSS 0.5%CVE-2026-54588CRITICALPoweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.EPSS 0.5%CVE-2024-4773HIGHWhen a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been useEPSS 0.5%CVE-2024-21723MEDIUM[20240202] - Core - Open redirect in installation applicationEPSS 0.5%CVE-2022-46288MEDIUMOpen redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to EPSS 0.5%CVE-2024-39694MEDIUMDuende IdentityServer Open Redirect vulnerabilityEPSS 0.5%CVE-2025-43526CRITICALThis issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enaEPSS 0.5%CVE-2022-27547MEDIUMHCL iNotes is susceptible to a link to non-existent domain vulnerability.EPSS 0.5%CVE-2023-24034LOWAn issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by usinEPSS 0.5%