Falhas do tipo CWE-601

1.191 resultados

Redirecionamento aberto (Open Redirect)

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro, query string, etc.) sem validar se o destino é confiável. Um atacante controla para onde a vítima é levada, usando a reputação da aplicação legítima para enganá-la e roubar credenciais ou distribuir malware.

Exemplo

Um site de login tem `redirect.php?url=https://exemplo.com/dashboard`. O atacante muda para `redirect.php?url=https://site-falso.com` e envia o link falso por phishing. A vítima clica confiando no domínio legítimo e acaba em um site fake que coleta suas credenciais.

Como mitigar

Valide e whitelist as URLs permitidas antes de redirecionar — nunca confie no input do usuário. Alternativamente, use IDs ou tokens que mapeiem para destinos pré-aprovados, ou verifique se a URL pertence ao mesmo domínio (validação com regex ou parsing seguro da URL).

CVE-2026-41008MEDIUMSpring Security Authorization Server Open Redirect via request_uriEPSS 0.3%CVE-2026-25149LOWQwik City Open Redirect via fixTrailingSlashEPSS 0.3%CVE-2025-2418MEDIUMOpen Redirect in TR7's Web Application FirewallEPSS 0.3%CVE-2026-45335MEDIUMWeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPageEPSS 0.3%CVE-2026-11502LOWJeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirectEPSS 0.3%CVE-2026-96773MEDIUMIntelliants Subrion CMS Login Page login.php authorize redirectEPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.2%CVE-2025-24868HIGHOpen Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)EPSS 0.2%CVE-2025-6286MEDIUMPHPGurukul COVID19 Testing Management System search-report-result.php redirectEPSS 0.2%CVE-2026-77609MEDIUMSemantic MediaWiki has an open redirect in Special:URIResolverEPSS 0.2%CVE-2024-21684LOWThere is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 tEPSS 0.2%CVE-2025-57878MEDIUMBUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.EPSS 0.2%CVE-2025-57872MEDIUMBUG-000174150 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.2%CVE-2025-20355MEDIUMCisco Catalyst Center Software HTTP Open Redirect VulnerabilityEPSS 0.2%CVE-2025-57879MEDIUMBUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2026-44833MEDIUMSnipe-IT: Open redirect vulnerabilityEPSS 0.2%CVE-2025-36016MEDIUMIBM Process Mining HTTP open redirectEPSS 0.2%CVE-2026-47002MEDIUMVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versEPSS 0.2%CVE-2026-62444MEDIUMVulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions tEPSS 0.2%CVE-2026-34283MEDIUMVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that areEPSS 0.2%