Weaknesses of type CWE-601

1,288 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2024-25608MEDIUMHtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 EPSS 1.0%CVE-2022-24776MEDIUMOpen Redirect in Flask-AppBuilderEPSS 1.0%CVE-2020-15241MEDIUMCross-Site Scripting in TYPO3 Fluid EngineEPSS 1.0%CVE-2023-34020MEDIUMWordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerabilityEPSS 1.0%CVE-2023-22298MEDIUMOpen redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitraryEPSS 1.0%CVE-2017-6018—An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceSEPSS 1.0%CVE-2023-6291HIGHKeycloak: redirect_uri validation bypassEPSS 0.9%CVE-2021-21392MEDIUMOpen redirect via transitional IPv6 addresses on dual-stack networksEPSS 0.9%CVE-2022-23527MEDIUMOpen Redirect in oidc_validate_redirect_url()EPSS 0.9%CVE-2022-24887MEDIUMOpen Redirect in Nextcloud TalkEPSS 0.9%CVE-2020-7520—A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 andEPSS 0.9%CVE-2022-2252MEDIUMOpen Redirect in microweber/microweberEPSS 0.9%CVE-2022-3486MEDIUMAn open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5EPSS 0.9%CVE-2018-3743—Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.EPSS 0.9%CVE-2020-1997MEDIUMPAN-OS: GlobalProtect registration open redirectEPSS 0.9%CVE-2022-24739HIGHServer-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltubeEPSS 0.9%CVE-2021-3647MEDIUMOpen Redirect in medialize/URI.jsEPSS 0.9%CVE-2020-5409HIGHConcourse Open Redirect in the /sky/login endpointEPSS 0.9%CVE-2017-8451—With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to cEPSS 0.9%CVE-2022-41204HIGHAn attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They caEPSS 0.9%