Falhas do tipo CWE-601

1.191 resultados

Redirecionamento aberto (Open Redirect)

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro, query string, etc.) sem validar se o destino é confiável. Um atacante controla para onde a vítima é levada, usando a reputação da aplicação legítima para enganá-la e roubar credenciais ou distribuir malware.

Exemplo

Um site de login tem `redirect.php?url=https://exemplo.com/dashboard`. O atacante muda para `redirect.php?url=https://site-falso.com` e envia o link falso por phishing. A vítima clica confiando no domínio legítimo e acaba em um site fake que coleta suas credenciais.

Como mitigar

Valide e whitelist as URLs permitidas antes de redirecionar — nunca confie no input do usuário. Alternativamente, use IDs ou tokens que mapeiem para destinos pré-aprovados, ou verifique se a URL pertence ao mesmo domínio (validação com regex ou parsing seguro da URL).

CVE-2026-59355MEDIUMSpring Authorization Server: Open Redirect via request_uri parameterEPSS 0.2%CVE-2024-45247MEDIUMSonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.2%CVE-2026-23730MEDIUMWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)EPSS 0.2%CVE-2024-7211MEDIUMThe Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites.EPSS 0.2%CVE-2024-42341MEDIUMLoway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.2%CVE-2026-23729MEDIUMWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)EPSS 0.2%CVE-2026-61901MEDIUMJoomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2EPSS 0.2%CVE-2026-42207MEDIUMMagento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-ltsEPSS 0.2%CVE-2026-23726MEDIUMWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)EPSS 0.2%CVE-2025-70032MEDIUMAn issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.EPSS 0.2%CVE-2025-5256MEDIUMOpen Redirect vulnerability on user unlock pathEPSS 0.2%CVE-2025-43795MEDIUMOpen redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , EPSS 0.2%CVE-2025-13819MEDIUMOpen redirect in web server of MiR robots and MiR fleetEPSS 0.2%CVE-2025-64115MEDIUMMovary unvalidated Referer header allows open redirect and phishingEPSS 0.2%CVE-2025-8737MEDIUMzlt2000 microservices-platform OauthLogoutSuccessHandler.java onLogoutSuccess redirectEPSS 0.2%CVE-2024-30140MEDIUMHCL BigFix Compliance is affected by unvalidated redirects and forwardsEPSS 0.2%CVE-2026-45037HIGHTabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocationEPSS 0.2%CVE-2025-20291MEDIUMA vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user toEPSS 0.2%CVE-2025-20378LOWOpen Redirect on Web Login endpoint in Splunk EnterpriseEPSS 0.2%CVE-2025-64116MEDIUMMovary vulnerable to an open redirectEPSS 0.2%