Weaknesses of type CWE-601

1,185 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2024-4133MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open RedirectEPSS 0.5%CVE-2026-25854MEDIUMApache Tomcat: Occasionally open redirectEPSS 0.5%CVE-2023-31134MEDIUMTauri Open Redirect Vulnerability Possibly Exposes IPC to External SitesEPSS 0.5%CVE-2026-55087MEDIUMEtherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)EPSS 0.5%CVE-2025-64716MEDIUMAnubis vulnerable to possible XSS via redir parameter when using subrequest auth modeEPSS 0.5%CVE-2025-68509MEDIUMWordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerabilityEPSS 0.5%CVE-2017-20164MEDIUMSymbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirectEPSS 0.5%CVE-2022-38201MEDIUMAn unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.EPSS 0.5%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%CVE-2022-38779—An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyEPSS 0.5%CVE-2022-39021MEDIUMe-Excellence Inc. U-Office Force - Open RedirectEPSS 0.5%CVE-2024-0781LOWCodeAstro Internet Banking System pages_client_signup.php redirectEPSS 0.5%CVE-2024-27592MEDIUMOpen Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted linEPSS 0.5%CVE-2021-29456MEDIUMAuthelia allows open redirects on the logout endpointEPSS 0.5%CVE-2026-13163MEDIUMLack of input validation in Mailerup input parameter leads to Open RedirectEPSS 0.5%CVE-2023-29307MEDIUMOpen Redirect on AEM TargetEPSS 0.5%CVE-2026-44503HIGHKiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectEPSS 0.5%CVE-2024-11955MEDIUMGLPI index.php redirectEPSS 0.5%CVE-2022-22797MEDIUMSysaid – sysaid Open RedirectEPSS 0.5%CVE-2026-7504HIGHOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakEPSS 0.5%