Weaknesses of type CWE-601

1,291 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2024-4773HIGHWhen a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been useEPSS 0.5%CVE-2022-38201MEDIUMAn unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.EPSS 0.5%CVE-2024-21723MEDIUM[20240202] - Core - Open redirect in installation applicationEPSS 0.5%CVE-2024-39694MEDIUMDuende IdentityServer Open Redirect vulnerabilityEPSS 0.5%CVE-2025-43526CRITICALThis issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enaEPSS 0.5%CVE-2024-37656MEDIUMAn open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL paramEPSS 0.5%CVE-2022-41215MEDIUMSAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URLEPSS 0.5%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%CVE-2024-4133MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open RedirectEPSS 0.5%CVE-2026-53654MEDIUMGrav: Unauthenticated open redirect via login twofa_cancel _redirectEPSS 0.5%CVE-2026-49826NONEConcourse login flow has an open redirect issueEPSS 0.5%CVE-2023-31134MEDIUMTauri Open Redirect Vulnerability Possibly Exposes IPC to External SitesEPSS 0.5%CVE-2025-58044MEDIUMJumpServer has an Open Redirect VulnerabilityEPSS 0.5%CVE-2025-46826LOWinsa-auth Open-Redirect on provided CAS server login endpointEPSS 0.5%CVE-2025-68509MEDIUMWordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerabilityEPSS 0.5%CVE-2022-38779—An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyEPSS 0.5%CVE-2025-62428HIGHDrawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` EndpointsEPSS 0.5%CVE-2022-38208MEDIUMUnvalidated redirect in Portal for ArcGISEPSS 0.5%CVE-2026-1296MEDIUMFrontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' ParameterEPSS 0.5%CVE-2022-4720MEDIUMOpen Redirect in ikus060/rdiffwebEPSS 0.5%