Fallos del tipo CWE-601

1187 resultados

Redirecionamento para URL não validada (Open Redirect)

A aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro GET/POST, referer, etc.) sem validar se o destino é confiável. Um atacante pode usar isso para levar vítimas a sites maliciosos, phishing ou roubo de credenciais, enquanto a URL legítima da sua app aparece no clique inicial.

Ejemplo

Um site de e-commerce redireciona após login com `redirect.php?url=google.com`. Um atacante envia `redirect.php?url=seusite-fake.com` disfarçado de e-mail de confirmação. A vítima clica, vê a URL legítima na barra de endereço até o redirecionamento, e cai em um fake convincente.

Cómo mitigar

Valide a URL de destino contra uma whitelist de domínios permitidos ou, no mínimo, verifique se o host da URL é o seu próprio domínio antes de redirecionar. Nunca redirecione para URLs externas fornecidas pelo usuário sem controle explícito.

CVE-2025-53535LOWBetter Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple RoutesEPSS 0.3%CVE-2024-31282MEDIUMWordPress App Builder plugin <= 3.8.7 - Open Redirection vulnerabilityEPSS 0.3%CVE-2024-3597HIGHExport WP Page to Static HTML/CSS <= 2.2.2 - Open RedirectEPSS 0.3%CVE-2024-47646MEDIUMWordPress Payflex Payment Gateway plugin <= 2.6.1 - Open Redirection vulnerabilityEPSS 0.3%CVE-2024-47354MEDIUMWordPress Simple Membership After Login Redirection plugin <= 1.6 - Open Redirection vulnerabilityEPSS 0.3%CVE-2025-55624MEDIUMAn intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-pEPSS 0.3%CVE-2025-10229MEDIUMFreshwork logout redirectEPSS 0.3%CVE-2025-49325MEDIUMWordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection VulnerabilityEPSS 0.3%CVE-2025-24020MEDIUMWeGIA Open Redirect vulnerabilityEPSS 0.3%CVE-2023-50963MEDIUMIBM Storage Defender HTTP HOST header injectionEPSS 0.3%CVE-2026-60467HIGHVulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affectedEPSS 0.3%CVE-2023-0681MEDIUMRapid7 Nexpose Uncontrolled URL RedirectEPSS 0.3%CVE-2026-40332MEDIUMMasa CMS open redirect via improper handling of scheme-relative URLsEPSS 0.3%CVE-2024-1240MEDIUMOpen Redirection in pyload/pyloadEPSS 0.3%CVE-2026-60945HIGHVulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions thaEPSS 0.3%CVE-2024-25676MEDIUMAn issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leadsEPSS 0.3%CVE-2023-31229MEDIUMWordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open RedirectionEPSS 0.3%CVE-2026-61078HIGHVulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application ObjectsEPSS 0.3%CVE-2024-44776MEDIUMAn Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a craftEPSS 0.3%CVE-2026-5467MEDIUMCasdoor OAuth Authorization Request redirectEPSS 0.3%