Fallos del tipo CWE-601

1187 resultados

Redirecionamento para URL não validada (Open Redirect)

A aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro GET/POST, referer, etc.) sem validar se o destino é confiável. Um atacante pode usar isso para levar vítimas a sites maliciosos, phishing ou roubo de credenciais, enquanto a URL legítima da sua app aparece no clique inicial.

Ejemplo

Um site de e-commerce redireciona após login com `redirect.php?url=google.com`. Um atacante envia `redirect.php?url=seusite-fake.com` disfarçado de e-mail de confirmação. A vítima clica, vê a URL legítima na barra de endereço até o redirecionamento, e cai em um fake convincente.

Cómo mitigar

Valide a URL de destino contra uma whitelist de domínios permitidos ou, no mínimo, verifique se o host da URL é o seu próprio domínio antes de redirecionar. Nunca redirecione para URLs externas fornecidas pelo usuário sem controle explícito.

CVE-2023-23853MEDIUMAn unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753,EPSS 0.3%CVE-2026-48784MEDIUMSymfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 NormalizationEPSS 0.3%CVE-2023-22418MEDIUMBIG-IP APM virtual server vulnerabilityEPSS 0.3%CVE-2025-32694MEDIUMWordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerabilityEPSS 0.3%CVE-2023-20884MEDIUMVMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may bEPSS 0.3%CVE-2026-45065LOWSymfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL InjectionEPSS 0.3%CVE-2024-23664MEDIUMA URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 aEPSS 0.3%CVE-2023-34224MEDIUMIn JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possibleEPSS 0.3%CVE-2025-6089MEDIUMAstun Technology iShare Maps atCheckJS.aspx redirectEPSS 0.3%CVE-2025-40846HIGHHaloITSM open redirect via the returnUrlEPSS 0.3%CVE-2026-25779MEDIUMGitea redirect handling permits open redirects through backslash pathsEPSS 0.3%CVE-2026-54215MEDIUMTeamDavid: Open Redirect via the 'replyUrl' parameterEPSS 0.3%CVE-2026-63768MEDIUMcal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned StateEPSS 0.3%CVE-2026-32824HIGHdataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect TargetsEPSS 0.3%CVE-2024-12561MEDIUMAffiliate Sales in Google Analytics and other tools <= 2.0.0 - Open RedirectEPSS 0.3%CVE-2024-21065MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported versions that are affeEPSS 0.3%CVE-2025-7953MEDIUMSanluan PublicCMS viewer.html redirectEPSS 0.3%CVE-2025-64101HIGHZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header InjectionEPSS 0.3%CVE-2026-64941LOWOpen redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CREPSS 0.3%CVE-2024-28076HIGHSolarWinds Platform Arbitrary Open Redirection VulnerabilityEPSS 0.3%