cve.bz

CWE-601: URL Redirection to Untrusted Site (Open Redirect), page 22

Filter

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

What the weakness is: CWE-601 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-178 Cross-Site Flashing Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-601, as MITRE names them. Credits.

Ask an AI about CWE-601

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-601: URL Redirection to Untrusted Site and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/601.html and https://cve.bz/cve/cwe/601?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2023-20884EPSS 0.3%

    VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading …

  2. 6.1CVE-2023-28370EPSS 1.1%

    Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

  3. 6.1CVE-2023-31245EPSS 0.4%

    Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection. Attackers could impersonate a device and supply malicious information about the device’s web server interface. B…

  4. 6.1CVE-2023-32068ExploitEPSS 54%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. Th…

  5. 6.1CVE-2023-25829EPSS 0.5%

    There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

  6. 5.4CVE-2023-31134EPSS 0.5%

    Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be…

  7. 6.1CVE-2020-21038EPSS 0.5%

    Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.

  8. 4.7CVE-2022-43950EPSS 0.4%

    A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an unauthentic…

  9. 5.4CVE-2023-0155EPSS 0.8%

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown

  10. 5.4CVE-2023-2000EPSS 0.4%

    Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website

  11. 6.1CVE-2015-10104EPSS 0.6%

    A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipula…

  12. 6.1CVE-2023-22729EPSS 0.4%

    Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legit…

  13. 6.1CVE-2023-26494EPSS 0.6%

    lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may …

  14. 6.1CVE-2015-10102EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to open redirect. The attack may be launched remotely. Upg…

  15. 6.1CVE-2023-29204ExploitEPSS 1.8%

    XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting…

  16. 6.1CVE-2022-46886EPSS 0.3%

    There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.

  17. 6.1CVE-2023-24935EPSS 1.0%

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

  18. 5.4CVE-2023-22641EPSS 0.3%

    A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiPro…

  19. 5.4CVE-2023-28069EPSS 0.4%

    Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. A remote unauthenticated attacker can phish the legitimate user to redirect to malicious website leading to information disclosure and launch of phishing attac…

  20. 3.9CVE-2022-1230EPSS 0.4%

    This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phones. An attacker must first obtain the ability to execute low-privileged code on the target system in …

  21. 7.4CVE-2022-48358EPSS 0.3%

    The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.

  22. 6.1CVE-2022-2237EPSS 0.4%

    A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

  23. 6.1CVE-2023-28628EPSS 0.5%

    lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is si…

  24. 6.1CVE-2016-15030EPSS 0.4%

    A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of the argument from leads to open redirect. It is possible to initiate the attack…

  25. 5.4CVE-2023-22266EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  26. 5.4CVE-2023-22265EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  27. 5.4CVE-2023-22264EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  28. 5.4CVE-2023-22263EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  29. 5.4CVE-2023-22262EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  30. 5.4CVE-2023-22261EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  31. 5.4CVE-2023-22260EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  32. 5.4CVE-2023-22259EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  33. 5.4CVE-2023-22258EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  34. 5.4CVE-2023-22257EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  35. 5.4CVE-2023-22256EPSS 0.5%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious…

  36. 6.1CVE-2022-37940EPSS 0.3%

    Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow host header injection and URL redirection. HPE has made the following software to …

  37. 6.1CVE-2023-0681EPSS 0.3%

    Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ …

  38. 8.2CVE-2023-24892ExploitEPSS 3.5%

    Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability

  39. 3.1CVE-2023-23395EPSS 0.6%

    Microsoft SharePoint Server Spoofing Vulnerability

  40. 6.1CVE-2022-3381EPSS 0.6%

    An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could be used to redirect users to arbitrary sites

  41. 6.1CVE-2022-4317EPSS 0.5%

    An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.

  42. 6.1CVE-2023-24735ExploitEPSS 1.1%

    PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.

  43. 6.1CVE-2023-22432ExploitEPSS 2.4%

    Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishi…

  44. 6.1CVE-2020-36665EPSS 0.6%

    A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function eachValue of the file TwitterCards.php. The manipulation of the argument value leads to open redirect. Upgrading to ver…

  45. 6.1CVE-2020-36664EPSS 0.6%

    A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrad…

  46. 6.1CVE-2020-36663EPSS 0.6%

    A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the function makeTag of the file OpenGraph.php. The manipulation of the argument value leads to open redirect. Upgrading to ver…

  47. 6.1CVE-2022-2837EPSS 0.4%

    A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.

  48. 5.4CVE-2023-27292ExploitEPSS 1.0%

    An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.

  49. 6.1CVE-2022-46784EPSS 0.4%

    SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.)

  50. 6.1CVE-2022-38779EPSS 0.5%

    An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.