Falhas do tipo CWE-601

1.185 resultados

Redirecionamento aberto (Open Redirect)

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro, query string, etc.) sem validar se o destino é confiável. Um atacante controla para onde a vítima é levada, usando a reputação da aplicação legítima para enganá-la e roubar credenciais ou distribuir malware.

Exemplo

Um site de login tem `redirect.php?url=https://exemplo.com/dashboard`. O atacante muda para `redirect.php?url=https://site-falso.com` e envia o link falso por phishing. A vítima clica confiando no domínio legítimo e acaba em um site fake que coleta suas credenciais.

Como mitigar

Valide e whitelist as URLs permitidas antes de redirecionar — nunca confie no input do usuário. Alternativamente, use IDs ou tokens que mapeiem para destinos pré-aprovados, ou verifique se a URL pertence ao mesmo domínio (validação com regex ou parsing seguro da URL).

CVE-2025-32970MEDIUMorg.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerabilityEPSS 0.6%CVE-2024-28239MEDIUMURL Redirection to Untrusted Site in OAuth2/OpenID in directusEPSS 0.6%CVE-2010-4266—It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.EPSS 0.6%CVE-2021-23052—On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IPEPSS 0.6%CVE-2024-46331HIGHModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability alEPSS 0.6%CVE-2024-7260MEDIUMKeycloak-core: open redirect on account pageEPSS 0.6%CVE-2024-10812MEDIUMOpen Redirect in binary-husky/gpt_academicEPSS 0.6%CVE-2024-34074MEDIUMFrappe vuilnerable to an open redirect on login pageEPSS 0.6%CVE-2021-44054MEDIUMOpen redirectEPSS 0.6%CVE-2021-22141MEDIUMAn open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could EPSS 0.6%CVE-2025-55207MEDIUM@astrojs/node's trailing slash handling causes open redirect issueEPSS 0.6%CVE-2022-25799—An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0EPSS 0.6%CVE-2021-3851MEDIUMOpen Redirect in firefly-iii/firefly-iiiEPSS 0.6%CVE-2021-38678MEDIUMOpen Redirect Vulnerability in QcalAgentEPSS 0.6%CVE-2024-42353MEDIUMWebOb's location header normalization during redirect leads to open redirectEPSS 0.6%CVE-2021-1218MEDIUMCisco Smart Software Manager Satellite Open Redirect VulnerabilityEPSS 0.6%CVE-2024-24034MEDIUMSetor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary EPSS 0.6%CVE-2025-23363MEDIUMA vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V1EPSS 0.6%CVE-2025-65717MEDIUMAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML pEPSS 0.6%CVE-2022-3280LOWAn open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an EPSS 0.6%