Weaknesses of type CWE-601

1,184 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2019-19758MEDIUMA vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unautheEPSS 0.9%CVE-2020-5329MEDIUMDell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirectEPSS 0.9%CVE-2020-3311MEDIUMCisco Firepower Management Center Open Redirect VulnerabilityEPSS 0.8%CVE-2020-3178MEDIUMCisco Content Security Management Appliance Open Redirect VulnerabilitiesEPSS 0.8%CVE-2020-15234MEDIUMRedirect URL matching ignores character casingEPSS 0.8%CVE-2022-0122MEDIUMOpen Redirect in digitalbazaar/forgeEPSS 0.8%CVE-2026-64645HIGHNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnameEPSS 0.8%CVE-2021-3829HIGHOpen Redirect in openwhyd/openwhydEPSS 0.8%CVE-2018-3819—The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirectEPSS 0.8%CVE-2019-3788HIGHUAA redirect-uri allows wildcard in the subdomainEPSS 0.8%CVE-2020-5270MEDIUMOpen redirection when using back parameter of PrestaShopEPSS 0.8%CVE-2021-1397MEDIUMCisco Integrated Management Controller Open Redirect VulnerabilityEPSS 0.8%CVE-2023-42502MEDIUMApache Superset: Open Redirect VulnerabilityEPSS 0.8%CVE-2022-41204HIGHAn attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They caEPSS 0.8%CVE-2021-21377MEDIUMOpen Redirect in OMERO.webEPSS 0.8%CVE-2021-38343MEDIUMNested Pages <= 3.1.15 Open RedirectEPSS 0.8%CVE-2021-4000MEDIUMOpen Redirect in star7th/showdocEPSS 0.8%CVE-2021-35966MEDIUMLearningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.8%CVE-2022-28215—SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious siEPSS 0.8%CVE-2024-11044MEDIUMOpen Redirect in automatic1111/stable-diffusion-webuiEPSS 0.8%