Fallos del tipo CWE-601

1185 resultados

Redirecionamento para URL não validada (Open Redirect)

A aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro GET/POST, referer, etc.) sem validar se o destino é confiável. Um atacante pode usar isso para levar vítimas a sites maliciosos, phishing ou roubo de credenciais, enquanto a URL legítima da sua app aparece no clique inicial.

Ejemplo

Um site de e-commerce redireciona após login com `redirect.php?url=google.com`. Um atacante envia `redirect.php?url=seusite-fake.com` disfarçado de e-mail de confirmação. A vítima clica, vê a URL legítima na barra de endereço até o redirecionamento, e cai em um fake convincente.

Cómo mitigar

Valide a URL de destino contra uma whitelist de domínios permitidos ou, no mínimo, verifique se o host da URL é o seu próprio domínio antes de redirecionar. Nunca redirecione para URLs externas fornecidas pelo usuário sem controle explícito.

CVE-2024-4133MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open RedirectEPSS 0.5%CVE-2026-25854MEDIUMApache Tomcat: Occasionally open redirectEPSS 0.5%CVE-2023-31134MEDIUMTauri Open Redirect Vulnerability Possibly Exposes IPC to External SitesEPSS 0.5%CVE-2026-55087MEDIUMEtherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)EPSS 0.5%CVE-2025-64716MEDIUMAnubis vulnerable to possible XSS via redir parameter when using subrequest auth modeEPSS 0.5%CVE-2025-68509MEDIUMWordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerabilityEPSS 0.5%CVE-2017-20164MEDIUMSymbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirectEPSS 0.5%CVE-2022-38201MEDIUMAn unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.EPSS 0.5%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%CVE-2022-38779—An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyEPSS 0.5%CVE-2022-39021MEDIUMe-Excellence Inc. U-Office Force - Open RedirectEPSS 0.5%CVE-2024-0781LOWCodeAstro Internet Banking System pages_client_signup.php redirectEPSS 0.5%CVE-2024-27592MEDIUMOpen Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted linEPSS 0.5%CVE-2021-29456MEDIUMAuthelia allows open redirects on the logout endpointEPSS 0.5%CVE-2026-13163MEDIUMLack of input validation in Mailerup input parameter leads to Open RedirectEPSS 0.5%CVE-2023-29307MEDIUMOpen Redirect on AEM TargetEPSS 0.5%CVE-2026-44503HIGHKiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectEPSS 0.5%CVE-2024-11955MEDIUMGLPI index.php redirectEPSS 0.5%CVE-2022-22797MEDIUMSysaid – sysaid Open RedirectEPSS 0.5%CVE-2026-7504HIGHOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakEPSS 0.5%