Fallos del tipo CWE-601

1191 resultados

Redirecionamento para URL não validada (Open Redirect)

A aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro GET/POST, referer, etc.) sem validar se o destino é confiável. Um atacante pode usar isso para levar vítimas a sites maliciosos, phishing ou roubo de credenciais, enquanto a URL legítima da sua app aparece no clique inicial.

Ejemplo

Um site de e-commerce redireciona após login com `redirect.php?url=google.com`. Um atacante envia `redirect.php?url=seusite-fake.com` disfarçado de e-mail de confirmação. A vítima clica, vê a URL legítima na barra de endereço até o redirecionamento, e cai em um fake convincente.

Cómo mitigar

Valide a URL de destino contra uma whitelist de domínios permitidos ou, no mínimo, verifique se o host da URL é o seu próprio domínio antes de redirecionar. Nunca redirecione para URLs externas fornecidas pelo usuário sem controle explícito.

CVE-2025-44109MEDIUMA URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.EPSS 0.3%CVE-2026-25149LOWQwik City Open Redirect via fixTrailingSlashEPSS 0.3%CVE-2026-41008MEDIUMSpring Security Authorization Server Open Redirect via request_uriEPSS 0.3%CVE-2026-11502LOWJeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirectEPSS 0.3%CVE-2026-45335MEDIUMWeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPageEPSS 0.3%CVE-2026-96773MEDIUMIntelliants Subrion CMS Login Page login.php authorize redirectEPSS 0.3%CVE-2025-24868HIGHOpen Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)EPSS 0.2%CVE-2026-77609MEDIUMSemantic MediaWiki has an open redirect in Special:URIResolverEPSS 0.2%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.2%CVE-2025-6286MEDIUMPHPGurukul COVID19 Testing Management System search-report-result.php redirectEPSS 0.2%CVE-2024-21684LOWThere is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 tEPSS 0.2%CVE-2025-57878MEDIUMBUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.EPSS 0.2%CVE-2025-57872MEDIUMBUG-000174150 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.2%CVE-2025-57879MEDIUMBUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2025-20355MEDIUMCisco Catalyst Center Software HTTP Open Redirect VulnerabilityEPSS 0.2%CVE-2026-44833MEDIUMSnipe-IT: Open redirect vulnerabilityEPSS 0.2%CVE-2025-36016MEDIUMIBM Process Mining HTTP open redirectEPSS 0.2%CVE-2026-47002MEDIUMVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versEPSS 0.2%CVE-2026-34284MEDIUMVulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+). SupportEPSS 0.2%CVE-2025-64250MEDIUMWordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerabilityEPSS 0.2%