Weaknesses of type CWE-601

1,291 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2020-36665MEDIUMArtesãos SEOTools TwitterCards.php eachValue redirectEPSS 0.6%CVE-2024-10812MEDIUMOpen Redirect in binary-husky/gpt_academicEPSS 0.6%CVE-2024-28239MEDIUMURL Redirection to Untrusted Site in OAuth2/OpenID in directusEPSS 0.6%CVE-2021-44054MEDIUMOpen redirectEPSS 0.6%CVE-2026-25854MEDIUMApache Tomcat: Occasionally open redirectEPSS 0.6%CVE-2010-4266—It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.EPSS 0.6%CVE-2021-23052—On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IPEPSS 0.6%CVE-2023-20263MEDIUMA vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker toEPSS 0.6%CVE-2024-46331HIGHModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability alEPSS 0.6%CVE-2024-7260MEDIUMKeycloak-core: open redirect on account pageEPSS 0.6%CVE-2026-55087MEDIUMEtherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)EPSS 0.6%CVE-2026-107020HIGHAn issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim userEPSS 0.6%CVE-2024-34074MEDIUMFrappe vuilnerable to an open redirect on login pageEPSS 0.6%CVE-2022-46288MEDIUMOpen redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to EPSS 0.6%CVE-2021-1218MEDIUMCisco Smart Software Manager Satellite Open Redirect VulnerabilityEPSS 0.6%CVE-2021-3851MEDIUMOpen Redirect in firefly-iii/firefly-iiiEPSS 0.6%CVE-2024-42353MEDIUMWebOb's location header normalization during redirect leads to open redirectEPSS 0.6%CVE-2025-54414MEDIUMAnubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttonsEPSS 0.6%CVE-2026-66829LOWhtml_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirectionEPSS 0.6%CVE-2025-23363MEDIUMA vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V1EPSS 0.6%