CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- magazine3 core web vitals & pagespeed booster, core web vitals \& pagespeed booster +1 moreWordPress Core Web Vitals & PageSpeed Booster Plugin <= 1.0.12 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for salesforce and contact form 7, wpforms, elementor, ninja forms, crmperks integration for salesforce and contact form 7\, wpforms\, elementor\, ninja forms +1 moreWordPress Integration for Contact Form 7 and Salesforce Plugin <= 1.3.3 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for woocommerce and quickbooksWordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for woocommerce and zoho crm, books, invoice, inventory, bigin, crmperks integration for woocommerce and zoho crm\, books\, invoice\, inventory\, bigin +1 moreWordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open Redirection4.7 Medium
- doofinder, doofinder wp & woocommerce search +1 moreWordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open Redirection4.7 Medium
- swapnil v. patil login and logout redirectWordPress Login and Logout Redirect Plugin <= 2.0.3 is vulnerable to Open Redirection4.7 Medium
- servit affiliate-toolkit, servit software solutions affiliate-toolkit – wordpress affiliate plugin +1 moreWordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open Redirection4.7 Medium
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.8 +7 more +9 moreKeycloak: open redirect via "form_post.jwt" jarm response mode4.6 Medium
- uffizio gps trackerAn Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker...6.1 Medium
- beckhoff authelia-bhf, authelia-bhf of twincat/bsd +1 moreBeckhoff: Open redirect in TwinCAT/BSD package authelia-bhf4.7 Medium
- apache shiroApache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.6.1 Medium
- schneider electric trio e-series ethernet data radio, trio j-series ethernet data radio, trio q-series ethernet data radio +16 more +18 moreA CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could...8.2 High
- jenkins openid connect authentication, jenkins project openid connect authentication plugin +1 moreOpen redirect vulnerability in Jenkins OpenId Connect Authentication Plugin6.1 Medium
- alkacon open cms, opencms +1 moreOpen Redirect in Alkacon Software OpenCms6.1 Medium
- zammadAn issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in...5.3 Medium
- seafileThe next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect...6.1 Medium
- franklin-electric system sentinel anywareFranklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open...6.1 Medium
- michael uno (miunosoft) responsive column widgetsWordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection4.7 Medium
- princeahmed integrate google drive – browse, upload, download, embed, play, share, gallery, and manage your google drive files into your wordpress site, softlabbd integrate google drive +1 moreWordPress Integrate Google Drive Plugin <= 1.3.2 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for constant contact and contact form 7, wpforms, elementor, ninja forms, crmperks integration for constant contact and contact form 7\, wpforms\, elementor\, ninja +1 moreWordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open Redirection4.7 Medium
- pluginops landing page builder – lead page – optin page – squeeze page – wordpress landing pages, landing page builder +1 moreWordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection4.7 Medium
- huawei emui, harmonyos +1 moreUnauthorized access vulnerability in the launcher module. Successful exploitation of this...7.5 High
- implem inc. pleasanterOpen redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated...6.1 Medium
- keking kkfileviewkkFileView v4.3.0 is vulnerable to Incorrect Access Control.6.1 Medium
- cainor calendarinhoOpen Redirect in Login Function of Calendarinho4.7 Medium
- apache supersetApache Superset: Open Redirect Vulnerability4.8 Medium
- mattermostOpen redirect in /oauth/<service>/mobile_login?redirect_to=4.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreAn attacker could have performed HTML template injection via Reader Mode and exfiltrated user...6.1 Medium
- owncloud oauth2An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is...8.7 High
- s-sols seraphinite acceleratorSeraphinite Accelerator < 2.20.29 - Authenticated Arbitrary Redirect5.4 Medium
- mcafee epolicy orchestratorAn open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a...5.4 Medium
- payara, payara platform server, micro and embedded +1 morePayara Platform: URL Redirection to untrusted site using FORM authentication6.1 Medium
- schneider electric ecostruxure power monitoring expert (pme), ecostruxure power operation (epo) – advanced reporting and dashboards module, ecostruxure power scada operation (pso) - advanced reporting and dashboards module +1 more +3 moreA CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an...8.2 High
- code-projects online examination systemOnline Examination System v1.0 - Multiple Open Redirects6.1 Medium
- code-projects online examination systemOnline Examination System v1.0 - Multiple Open Redirects6.1 Medium
- code-projects online examination systemOnline Examination System v1.0 - Multiple Open Redirects6.1 Medium
- cisco adaptive security appliance (asa) software, adaptive security appliance software, firepower threat defense software +1 more +3 moreA vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single...6.1 Medium
- vmware workspace one uemVMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may...8.8 High
- cure53 dompurifyDOMPurify Open Redirect vulnerability6.1 Medium
- microfocus service management automation x, asset management x, opentext asset management x (amx) +1 more +3 morePotential open redirect vulnerability in opentext SMAX and AMX product.8.2 High
- sisqualwfmThe sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection...6.1 Medium
- vonautomatisch django grappelliDjango Grappelli Open Redirect vulnerability6.1 Medium
- zzzcms zzzphpzzzcms v2.2.0 was discovered to contain an open redirect vulnerability.6.1 Medium
- python urllib3Authorization Header forwarded on redirect6.1 Medium
- mosparo, mosparo mosparo/mosparo +1 moreOpen Redirect in mosparo/mosparo4.3 Medium
- gitlabURL Redirection to Untrusted Site ('Open Redirect') in GitLab3.0 Low
- symantec identity portal, symantec - a division of broadcom identity governance and administration +1 moreOpen Redirection Vulnerability in Symantec Identity Portal 14.45.4 Medium
- phpipamphpipam Header redirect2.7 Low
- icewarp deep castle g2An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute...6.1 Medium
- couchcmsAn open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers...6.1 Medium
- Show moreLoading…