Weaknesses of type CWE-601

1,183 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2019-1943MEDIUMCisco Small Business Series Switches Open Redirect VulnerabilityEPSS 9.4%CVE-2022-1702—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an exterEPSS 9.1%CVE-2019-11269MEDIUMOpen Redirector in spring-security-oauth2EPSS 8.9%CVE-2021-21337MEDIUMURL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthServiceEPSS 8.4%CVE-2020-15129MEDIUMOpen redirect in TraefikEPSS 8.0%CVE-2020-11034MEDIUMbypass of manageRedirect in GLPIEPSS 7.6%CVE-2024-8897MEDIUMUnder certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be EPSS 7.6%CVE-2025-0244MEDIUMAddress bar spoofing using an invalid protocol scheme on Firefox for AndroidEPSS 6.5%CVE-2020-8559MEDIUMPrivilege escalation from compromised node to clusterEPSS 6.1%CVE-2023-41080—Apache Tomcat: Open redirect with FORM authenticationEPSS 6.0%CVE-2022-23102—A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerEPSS 5.3%CVE-2021-38000MEDIUMInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitraEPSS 4.9%KEVCVE-2019-3912—An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unautEPSS 4.8%CVE-2012-0518MEDIUMUnspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attEPSS 4.7%KEVCVE-2022-0165—Page Builder KingComposer <= 2.9.6 - Open RedirectEPSS 4.3%CVE-2021-44528—A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combinatiEPSS 4.2%CVE-2024-22243HIGHCVE-2024-22243: Spring Framework URL Parsing with Host ValidationEPSS 4.0%CVE-2022-0692MEDIUMOpen Redirect on Rudloff/alltube in rudloff/alltubeEPSS 3.4%CVE-2019-14830—A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoEPSS 3.3%CVE-2019-6741MEDIUMThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 EPSS 3.2%