Fallos del tipo CWE-601

1185 resultados

Redirecionamento para URL não validada (Open Redirect)

A aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro GET/POST, referer, etc.) sem validar se o destino é confiável. Um atacante pode usar isso para levar vítimas a sites maliciosos, phishing ou roubo de credenciais, enquanto a URL legítima da sua app aparece no clique inicial.

Ejemplo

Um site de e-commerce redireciona após login com `redirect.php?url=google.com`. Um atacante envia `redirect.php?url=seusite-fake.com` disfarçado de e-mail de confirmação. A vítima clica, vê a URL legítima na barra de endereço até o redirecionamento, e cai em um fake convincente.

Cómo mitigar

Valide a URL de destino contra uma whitelist de domínios permitidos ou, no mínimo, verifique se o host da URL é o seu próprio domínio antes de redirecionar. Nunca redirecione para URLs externas fornecidas pelo usuário sem controle explícito.

CVE-2025-32970MEDIUMorg.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerabilityEPSS 0.6%CVE-2024-28239MEDIUMURL Redirection to Untrusted Site in OAuth2/OpenID in directusEPSS 0.6%CVE-2010-4266—It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.EPSS 0.6%CVE-2021-23052—On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IPEPSS 0.6%CVE-2024-46331HIGHModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability alEPSS 0.6%CVE-2024-7260MEDIUMKeycloak-core: open redirect on account pageEPSS 0.6%CVE-2024-10812MEDIUMOpen Redirect in binary-husky/gpt_academicEPSS 0.6%CVE-2024-34074MEDIUMFrappe vuilnerable to an open redirect on login pageEPSS 0.6%CVE-2021-44054MEDIUMOpen redirectEPSS 0.6%CVE-2021-22141MEDIUMAn open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could EPSS 0.6%CVE-2025-55207MEDIUM@astrojs/node's trailing slash handling causes open redirect issueEPSS 0.6%CVE-2022-25799—An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0EPSS 0.6%CVE-2021-3851MEDIUMOpen Redirect in firefly-iii/firefly-iiiEPSS 0.6%CVE-2021-38678MEDIUMOpen Redirect Vulnerability in QcalAgentEPSS 0.6%CVE-2024-42353MEDIUMWebOb's location header normalization during redirect leads to open redirectEPSS 0.6%CVE-2021-1218MEDIUMCisco Smart Software Manager Satellite Open Redirect VulnerabilityEPSS 0.6%CVE-2024-24034MEDIUMSetor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary EPSS 0.6%CVE-2025-23363MEDIUMA vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V1EPSS 0.6%CVE-2025-65717MEDIUMAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML pEPSS 0.6%CVE-2022-3280LOWAn open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an EPSS 0.6%