cve.bz

CWE-601: URL Redirection to Untrusted Site (Open Redirect), page 20

Filter

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

What the weakness is: CWE-601 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-178 Cross-Site Flashing Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-601, as MITRE names them. Credits.

Ask an AI about CWE-601

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-601: URL Redirection to Untrusted Site and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/601.html and https://cve.bz/cve/cwe/601?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2023-37982EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elemen…

  2. 6.1CVE-2023-35883EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.

  3. 6.1CVE-2023-45105EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.3.9.

  4. 6.1CVE-2023-41648EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: from n/a through 2.0.3.

  5. 6.1CVE-2023-40602EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.

  6. 6.1CVE-2023-38481EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventor…

  7. 6.1CVE-2023-38478EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for WooCommerce and QuickBooks: from n/a through 1.2.3.

  8. 6.1CVE-2023-6927EPSS 1.1%

    A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to a…

  9. 6.1CVE-2020-17484EPSS 0.5%

    An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain.

  10. 4.7CVE-2023-6545EPSS 0.4%

    The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect antheli…

  11. 6.1CVE-2023-46750EPSS 1.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

  12. 6.1CVE-2023-5629EPSS 0.4%

    A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over HTTP.

  13. 6.1CVE-2023-50771EPSS 0.6%

    Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

  14. 6.1CVE-2023-6380ExploitEPSS 1.6%

    Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site…

  15. 5.3CVE-2023-50456EPSS 0.4%

    An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name.

  16. 6.1CVE-2023-28874EPSS 0.5%

    The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.

  17. 6.1CVE-2023-48928EPSS 0.5%

    Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The 'path' parameter of the prefs.asp resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted …

  18. 6.1CVE-2023-47548EPSS 0.4%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site.This issue affects Int…

  19. 6.1CVE-2023-45762EPSS 0.5%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7.

  20. 6.1CVE-2023-48325EPSS 0.4%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeez…

  21. 6.1CVE-2023-47779EPSS 0.4%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WP…

  22. 7.5CVE-2023-49240EPSS 0.4%

    Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.

  23. 6.1CVE-2023-46688EPSS 0.5%

    Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL.

  24. 6.1CVE-2023-48815EPSS 0.5%

    kkFileView v4.3.0 is vulnerable to Incorrect Access Control.

  25. 6.1CVE-2023-49281EPSS 0.6%

    Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks…

  26. 5.4CVE-2023-42502EPSS 0.8%

    An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects …

  27. 6.1CVE-2023-47168EPSS 0.4%

    Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=

  28. 6.1CVE-2023-49104EPSS 0.6%

    An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks t…

  29. 6.1CVE-2023-49061EPSS 0.3%

    An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120.

  30. 5.4CVE-2023-5610EPSS 0.4%

    The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect

  31. 5.4CVE-2023-5445EPSS 0.4%

    An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashbo…

  32. 6.1CVE-2023-41699EPSS 0.4%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedde…

  33. 6.1CVE-2023-5986EPSS 0.5%

    A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application t…

  34. 6.1CVE-2019-25155EPSS 0.6%

    DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

  35. 6.1CVE-2023-45203EPSS 0.5%

    Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.

  36. 6.1CVE-2023-45202EPSS 0.5%

    Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.

  37. 6.1CVE-2023-45201EPSS 0.5%

    Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.

  38. 6.1CVE-2023-20264EPSS 0.5%

    A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could a…

  39. 6.1CVE-2023-20886EPSS 0.4%

    VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.

  40. 6.1CVE-2023-4964EPSS 0.3%

    Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset Management X (AMX) versions 2021.08, 2021…

  41. 6.1CVE-2023-36085EPSS 0.6%

    The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect us…

  42. 6.1CVE-2021-46898EPSS 0.6%

    views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.

  43. 6.1CVE-2023-45909EPSS 0.3%

    zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.

  44. 6.1CVE-2018-25091EPSS 0.6%

    urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed t…

  45. 6.1CVE-2023-5375ExploitEPSS 39%

    Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.

  46. 7.1CVE-2023-3922EPSS 0.4%

    An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons …

  47. 5.4CVE-2023-23957EPSS 0.3%

    An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4

  48. 4.8CVE-2023-4965EPSS 0.6%

    A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. T…

  49. 6.1CVE-2023-40779ExploitEPSS 1.4%

    An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL.

  50. 6.1CVE-2023-41609EPSS 0.4%

    An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.