cve.bz

CWE-601: URL Redirection to Untrusted Site (Open Redirect), page 23

Filter

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

What the weakness is: CWE-601 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-178 Cross-Site Flashing Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-601, as MITRE names them. Credits.

Ask an AI about CWE-601

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-601: URL Redirection to Untrusted Site and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/601.html and https://cve.bz/cve/cwe/601?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2022-0637EPSS 0.4%

    open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6

  2. 6.1CVE-2023-23860EPSS 0.4%

    SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a link, which when clicked by an unsuspecting user can be used to redirect a user to …

  3. 5.4CVE-2023-23855EPSS 0.3%

    SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful attack could lead an attacker to read or modify the information or expose the user …

  4. 6.1CVE-2023-23853EPSS 0.3%

    An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can craft a link which when clicked by an unsuspecting user can be u…

  5. 5.4CVE-2022-38657EPSS 0.3%

    An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.

  6. 6.1CVE-2023-22798EPSS 0.5%

    Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This…

  7. 6.1CVE-2023-22797EPSS 0.6%

    An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted in…

  8. 6.1CVE-2023-0748EPSS 0.6%

    Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.

  9. 6.1CVE-2022-28923ExploitEPSS 1.4%

    Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.

  10. 6.1CVE-2023-22418EPSS 0.3%

    On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This v…

  11. 3.5CVE-2022-44718EPSS 0.3%

    An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an …

  12. 3.1CVE-2022-44717EPSS 0.3%

    An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an …

  13. 6.1CVE-2023-24445EPSS 0.7%

    Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

  14. 6.1CVE-2023-24044EPSS 2.3%

    A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names…

  15. 6.1CVE-2023-22298EPSS 1.0%

    Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

  16. 5.4CVE-2022-43721EPSS 1.0%

    An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and…

  17. 6.1CVE-2015-10052EPSS 0.5%Unsupported when assigned

    A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151. This affects the function bearbeiten/login. The manipulation leads to open redirect. It is possible to initiate the attack remotely. The patch is n…

  18. 4.7CVE-2022-3145EPSS 0.4%

    An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

  19. 6.1CVE-2022-39183EPSS 0.4%

    Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.

  20. 6.1CVE-2023-0042EPSS 0.4%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.

  21. 6.1CVE-2023-22958EPSS 0.5%

    The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter.

  22. 6.1CVE-2017-20164EPSS 0.5%

    A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of t…

  23. 6.1CVE-2022-3614EPSS 0.4%

    In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.

  24. 6.1CVE-2022-38208EPSS 0.5%

    There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

  25. 6.1CVE-2022-4720EPSS 0.5%

    Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.

  26. 6.1CVE-2020-36627EPSS 0.6%

    A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. U…

  27. 6.1CVE-2022-45413EPSS 0.5%

    Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.<br>*This issue only affects Firefox for Android. Other operating systems are not af…

  28. 6.1CVE-2022-36316EPSS 0.3%

    When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103.

  29. 6.5CVE-2022-34478EPSS 0.8%

    The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploite…

  30. 6.1CVE-2022-34474EPSS 0.4%

    Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate. This vulnerabi…

  31. 6.1CVE-2022-29912EPSS 0.7%

    Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.

  32. 6.1CVE-2022-29910EPSS 0.4%

    When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Fi…

  33. 6.1CVE-2022-4644EPSS 0.6%

    Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.

  34. 5.4CVE-2022-44488EPSS 0.5%

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicio…

  35. 6.1CVE-2021-4260EPSS 0.4%

    A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect. The attack can be initiated remotely. The name of the patch i…

  36. 6.1CVE-2022-47500EPSS 1.1%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component sinc…

  37. 6.1CVE-2022-38662EPSS 0.4%

    In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.

  38. 6.1CVE-2022-46288EPSS 0.6%

    Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted …

  39. 6.1CVE-2022-4589EPSS 0.5%

    A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.9 and classified as problematic. Affected by this vulnerability is the function returnTo of the file termsandconditions/views.py. The manipulation leads to open…

  40. 6.1CVE-2022-23527EPSS 0.9%

    mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existin…

  41. 6.1CVE-2022-41275EPSS 0.5%

    In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can be redirected to a malicious page that could read or modify sensitive informatio…

  42. 6.1CVE-2022-41273EPSS 0.5%

    Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim wit…

  43. 6.1CVE-2022-37927EPSS 0.4%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD).

  44. 6.1CVE-2022-46683EPSS 0.6%

    Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

  45. 6.1CVE-2022-45917ExploitEPSS 2.1%

    ILIAS before 7.16 has an Open Redirect.

  46. 9.3CVE-2022-41559EPSS 0.7%

    The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to exploit an open redirect on the affected system. A successful attack…

  47. 6.1CVE-2022-43479EPSS 1.0%

    Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web site and conduct a phishing attack.

  48. 6.1CVE-2022-41965EPSS 0.4%

    Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users.…

  49. 6.1CVE-2021-22141EPSS 0.6%

    An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.

  50. 6.1CVE-2022-38201EPSS 0.5%

    An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attac…