Falhas do tipo CWE-601

1.185 resultados

Redirecionamento aberto (Open Redirect)

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro, query string, etc.) sem validar se o destino é confiável. Um atacante controla para onde a vítima é levada, usando a reputação da aplicação legítima para enganá-la e roubar credenciais ou distribuir malware.

Exemplo

Um site de login tem `redirect.php?url=https://exemplo.com/dashboard`. O atacante muda para `redirect.php?url=https://site-falso.com` e envia o link falso por phishing. A vítima clica confiando no domínio legítimo e acaba em um site fake que coleta suas credenciais.

Como mitigar

Valide e whitelist as URLs permitidas antes de redirecionar — nunca confie no input do usuário. Alternativamente, use IDs ou tokens que mapeiem para destinos pré-aprovados, ou verifique se a URL pertence ao mesmo domínio (validação com regex ou parsing seguro da URL).

CVE-2025-68470MEDIUMReact Router has unexpected external redirect via untrusted pathsEPSS 0.5%CVE-2026-7504HIGHOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakEPSS 0.5%CVE-2024-21497MEDIUMVersions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker coulEPSS 0.5%CVE-2024-2419HIGHKeycloak: path traversal in the redirect validationEPSS 0.5%CVE-2025-40630MEDIUMOpen redirection vulnerability in IceWarp Mail ServerEPSS 0.5%CVE-2025-64754LOWJitsi Meet has DOM Redirect on Microsoft OAuth FlowEPSS 0.5%CVE-2026-67178HIGHOpen Redirect in MISP Installer-Generated Apache ConfigurationEPSS 0.5%CVE-2024-1227MEDIUMMultiple vulnerabilities in Rejetto's Http File ServerEPSS 0.5%CVE-2026-55590MEDIUMCakePHP: Open redirect weakness via backslash bypassEPSS 0.5%CVE-2025-46826LOWinsa-auth Open-Redirect on provided CAS server login endpointEPSS 0.5%CVE-2025-68602MEDIUMWordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerabilityEPSS 0.5%CVE-2024-37656MEDIUMAn open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL paramEPSS 0.5%CVE-2026-53654MEDIUMGrav: Unauthenticated open redirect via login twofa_cancel _redirectEPSS 0.5%CVE-2025-58044MEDIUMJumpServer has an Open Redirect VulnerabilityEPSS 0.5%CVE-2023-25829MEDIUMBUG-000155001 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.5%CVE-2021-22526MEDIUMOpen Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1EPSS 0.5%CVE-2023-3515LOWOpen Redirect in go-gitea/giteaEPSS 0.5%CVE-2023-6552MEDIUMOpen redirect in TasmoAdminEPSS 0.5%CVE-2024-31135MEDIUMIn JetBrains TeamCity before 2024.03 open redirect was possible on the login pageEPSS 0.5%CVE-2022-38208MEDIUMUnvalidated redirect in Portal for ArcGISEPSS 0.5%