Weaknesses of type CWE-601

1,288 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2020-4037MEDIUMOpen Redirect in OAuth2 ProxyEPSS 0.9%CVE-2019-10133LOWA flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not EPSS 0.9%CVE-2022-31193HIGHURL Redirection to Untrusted Site in Dspace JSPUIEPSS 0.9%CVE-2022-0122MEDIUMOpen Redirect in digitalbazaar/forgeEPSS 0.9%CVE-2017-16224—st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely differEPSS 0.9%CVE-2021-3829HIGHOpen Redirect in openwhyd/openwhydEPSS 0.9%CVE-2019-13422—Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially EPSS 0.9%CVE-2019-19758MEDIUMA vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unautheEPSS 0.9%CVE-2020-5329MEDIUMDell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirectEPSS 0.9%CVE-2026-103576MEDIUMActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.9%CVE-2022-26954MEDIUMMultiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting EPSS 0.9%CVE-2021-4000MEDIUMOpen Redirect in star7th/showdocEPSS 0.8%CVE-2024-11044MEDIUMOpen Redirect in automatic1111/stable-diffusion-webuiEPSS 0.8%CVE-2020-3311MEDIUMCisco Firepower Management Center Open Redirect VulnerabilityEPSS 0.8%CVE-2020-3178MEDIUMCisco Content Security Management Appliance Open Redirect VulnerabilitiesEPSS 0.8%CVE-2020-15234MEDIUMRedirect URL matching ignores character casingEPSS 0.8%CVE-2018-3819—The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirectEPSS 0.8%CVE-2019-3788HIGHUAA redirect-uri allows wildcard in the subdomainEPSS 0.8%CVE-2020-5270MEDIUMOpen redirection when using back parameter of PrestaShopEPSS 0.8%CVE-2021-1397MEDIUMCisco Integrated Management Controller Open Redirect VulnerabilityEPSS 0.8%