Fallos del tipo CWE-601

1185 resultados

Redirecionamento para URL não validada (Open Redirect)

A aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro GET/POST, referer, etc.) sem validar se o destino é confiável. Um atacante pode usar isso para levar vítimas a sites maliciosos, phishing ou roubo de credenciais, enquanto a URL legítima da sua app aparece no clique inicial.

Ejemplo

Um site de e-commerce redireciona após login com `redirect.php?url=google.com`. Um atacante envia `redirect.php?url=seusite-fake.com` disfarçado de e-mail de confirmação. A vítima clica, vê a URL legítima na barra de endereço até o redirecionamento, e cai em um fake convincente.

Cómo mitigar

Valide a URL de destino contra uma whitelist de domínios permitidos ou, no mínimo, verifique se o host da URL é o seu próprio domínio antes de redirecionar. Nunca redirecione para URLs externas fornecidas pelo usuário sem controle explícito.

CVE-2025-68470MEDIUMReact Router has unexpected external redirect via untrusted pathsEPSS 0.5%CVE-2026-7504HIGHOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakEPSS 0.5%CVE-2024-21497MEDIUMVersions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker coulEPSS 0.5%CVE-2024-2419HIGHKeycloak: path traversal in the redirect validationEPSS 0.5%CVE-2025-40630MEDIUMOpen redirection vulnerability in IceWarp Mail ServerEPSS 0.5%CVE-2025-64754LOWJitsi Meet has DOM Redirect on Microsoft OAuth FlowEPSS 0.5%CVE-2026-67178HIGHOpen Redirect in MISP Installer-Generated Apache ConfigurationEPSS 0.5%CVE-2024-1227MEDIUMMultiple vulnerabilities in Rejetto's Http File ServerEPSS 0.5%CVE-2026-55590MEDIUMCakePHP: Open redirect weakness via backslash bypassEPSS 0.5%CVE-2025-46826LOWinsa-auth Open-Redirect on provided CAS server login endpointEPSS 0.5%CVE-2025-68602MEDIUMWordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerabilityEPSS 0.5%CVE-2024-37656MEDIUMAn open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL paramEPSS 0.5%CVE-2026-53654MEDIUMGrav: Unauthenticated open redirect via login twofa_cancel _redirectEPSS 0.5%CVE-2025-58044MEDIUMJumpServer has an Open Redirect VulnerabilityEPSS 0.5%CVE-2023-25829MEDIUMBUG-000155001 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.5%CVE-2021-22526MEDIUMOpen Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1EPSS 0.5%CVE-2023-3515LOWOpen Redirect in go-gitea/giteaEPSS 0.5%CVE-2023-6552MEDIUMOpen redirect in TasmoAdminEPSS 0.5%CVE-2024-31135MEDIUMIn JetBrains TeamCity before 2024.03 open redirect was possible on the login pageEPSS 0.5%CVE-2022-38208MEDIUMUnvalidated redirect in Portal for ArcGISEPSS 0.5%