Weaknesses of type CWE-601

1,183 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2021-24210—PhastPress < 1.111 - Open RedirectEPSS 3.1%CVE-2022-0597MEDIUMOpen Redirect in microweber/microweberEPSS 3.0%CVE-2019-10955MEDIUMIn Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 EPSS 3.0%CVE-2021-24406—wpForo Forum < 1.9.7 - Open RedirectEPSS 2.9%CVE-2021-32618LOWOpen Redirect VulnerabilityEPSS 2.8%CVE-2025-50578CRITICALLinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` aEPSS 2.8%CVE-2022-0869MEDIUMMultiple Open Redirect in nitely/spiritEPSS 2.6%CVE-2022-40083CRITICALLabstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leEPSS 2.6%CVE-2024-22259HIGHCVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)EPSS 2.6%CVE-2021-28861MEDIUMPython 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginniEPSS 2.5%CVE-2019-3877MEDIUMA vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass thrEPSS 2.4%CVE-2023-22432MEDIUMOpen redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary EPSS 2.4%CVE-2021-32786MEDIUMOpen Redirect in oidc_validate_redirect_url()EPSS 2.4%CVE-2021-25033—Noptin < 1.6.5 - Open RedirectEPSS 2.3%CVE-2021-24358—The Plus Addons for Elementor Page Builder < 4.1.10 - Open RedirectEPSS 2.3%CVE-2021-24838—AnyComment < 0.3.5 - Open RedirectEPSS 2.2%CVE-2021-25074—WebP Converter for Media < 4.0.3 - Unauthenticated Open redirectEPSS 2.2%CVE-2023-24044MEDIUMA Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites vEPSS 2.2%CVE-2024-8883MEDIUMKeycloak: vulnerable redirect uri validation results in open redirecEPSS 2.1%CVE-2005-4206MEDIUMBlackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers tEPSS 2.1%