CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
Also known as Confused Deputy.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn isSystemUid of AccountManagerService.java, there is a possible way for an app to access...7.1 High
- google androidIn markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the...7.3 High
- google androidIn setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data...5.5 Medium
- google androidIn onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact...7.8 High
- google androidIn multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent...7.8 High
- google androidIn onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch...7.8 High
- google androidIn isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent...7.8 High
- google androidIn validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to...7.8 High
- google androidIn getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible...7.3 High
- kro.run krokro Confused Deputy vulnerability4.1 Medium
- google androidIn loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots...7.8 High
- coder code-servercode-server session cookie can be extracted by having user visit specially crafted proxy URL8.3 High
- jtekt electronics corporation hmi gc-a2 series, hmi viewjet c-more series +1 moreUnintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series...5.8 Medium
- google androidIn multiple locations, there is a possible confused deputy due to Intent Redirect. This could...7.8 High
- google androidIn onCreate of ChooserActivity.java , there is a possible way to view other users' images due to...7.8 High
- misskeyMisskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes9.3 Critical
- gitlabUnintended Proxy or Intermediary ('Confused Deputy') in GitLab4.3 Medium
- mitmproxyMitmweb API Authentication Bypass Using Proxy Server8.2 High
- hcl software nomad server on dominoAn open proxy vulnerability affects HCL Nomad server on Domino8.6 High
- google androidIn updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a...7.8 High
- pterodactyl wingsServer-side Request Forgery during remote file pull in Pterodactyl wings6.4 Medium
- moxa eds-4008 series, eds-4008 firmware, eds-4009 series +11 more +13 moreEDS-4000/G4000 Series IP Forwarding Vulnerability6.5 Medium
- google androidIn setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending...7.8 High
- federicoiosue omni-notes, omninotes omni notes +1 moreUncontrolled data used in content resolution6.3 Medium
- google androidIn getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to...5.5 Medium
- metabaseMetabase vulnerable to Remote Code Execution via H28.8 High
- tasksTasks.org vulnerable to data exfiltration by malicous app or adb5.5 Medium
- zk framework auuploader, zkoss zk framework +1 moreZK Framework vulnerable to malicious POST7.5 High
- devolutions server, filezilla-project filezilla server +1 moreFileZilla Server PORT confused deputy4.3 Medium
- sonicwall sma 200 firmware, sma 210 firmware, sma 400 firmware +3 more +5 moreAn unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary...9.8 Critical
- kubernetesHoles in EndpointSlice Validation Enable Host Network Hijack3.1 Low
- kubernetesWebhook redirect in kube-apiserver4.1 Medium
- projectcontour contourAuthorization bypass in Contour8.5 High
- racketConfused deputy attack in sandbox module resolution6.1 Medium
github.com/pterodactyl/wingsGoUnchecked hostname resolution could allow access to local network resources by users outside the local network6.4 Medium- coturn, fedoraproject fedora +1 moreLoopback bypass in Coturn7.2 High
- spring by vmware cloud netflix, vmware spring cloud netflix +1 moreHystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard6.5 Medium
- elog, fedoraproject fedora +1 moreELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote...6.5 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center Unintended Proxy Via SWIM Import Interface Vulnerability6.5 Medium
- tianocore edk ii, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii) +1 moreInsufficient memory write check in SMM service for EDK II may allow an authenticated user to...6.7 Medium
- mikrotik routeros, tenable mikrotik routeros +1 moreMikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an...7.5 High
- amazon freertos, web services freertos +1 moreAn issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0...5.9 Medium
- jenkins publish over cifsJenkins Publisher Over CIFS Plugin confused deputy vulnerability4.2 Medium
- grabacr.net kancolleviewerKanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers...9.1 Critical