Falhas do tipo CWE-601

1.185 resultados

Redirecionamento aberto (Open Redirect)

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro, query string, etc.) sem validar se o destino é confiável. Um atacante controla para onde a vítima é levada, usando a reputação da aplicação legítima para enganá-la e roubar credenciais ou distribuir malware.

Exemplo

Um site de login tem `redirect.php?url=https://exemplo.com/dashboard`. O atacante muda para `redirect.php?url=https://site-falso.com` e envia o link falso por phishing. A vítima clica confiando no domínio legítimo e acaba em um site fake que coleta suas credenciais.

Como mitigar

Valide e whitelist as URLs permitidas antes de redirecionar — nunca confie no input do usuário. Alternativamente, use IDs ou tokens que mapeiem para destinos pré-aprovados, ou verifique se a URL pertence ao mesmo domínio (validação com regex ou parsing seguro da URL).

CVE-2024-4133MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open RedirectEPSS 0.5%CVE-2026-25854MEDIUMApache Tomcat: Occasionally open redirectEPSS 0.5%CVE-2023-31134MEDIUMTauri Open Redirect Vulnerability Possibly Exposes IPC to External SitesEPSS 0.5%CVE-2026-55087MEDIUMEtherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)EPSS 0.5%CVE-2025-64716MEDIUMAnubis vulnerable to possible XSS via redir parameter when using subrequest auth modeEPSS 0.5%CVE-2025-68509MEDIUMWordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerabilityEPSS 0.5%CVE-2017-20164MEDIUMSymbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirectEPSS 0.5%CVE-2022-38201MEDIUMAn unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.EPSS 0.5%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%CVE-2022-38779—An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyEPSS 0.5%CVE-2022-39021MEDIUMe-Excellence Inc. U-Office Force - Open RedirectEPSS 0.5%CVE-2024-0781LOWCodeAstro Internet Banking System pages_client_signup.php redirectEPSS 0.5%CVE-2024-27592MEDIUMOpen Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted linEPSS 0.5%CVE-2021-29456MEDIUMAuthelia allows open redirects on the logout endpointEPSS 0.5%CVE-2026-13163MEDIUMLack of input validation in Mailerup input parameter leads to Open RedirectEPSS 0.5%CVE-2023-29307MEDIUMOpen Redirect on AEM TargetEPSS 0.5%CVE-2026-44503HIGHKiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectEPSS 0.5%CVE-2024-11955MEDIUMGLPI index.php redirectEPSS 0.5%CVE-2022-22797MEDIUMSysaid – sysaid Open RedirectEPSS 0.5%CVE-2026-7504HIGHOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakEPSS 0.5%