CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
Description
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-178
CVEs mapped to this weakness (1,693)
page 53 of 85| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-40754 | Med | 0.33 | 6.1 | 0.02 | Sep 21, 2022 | In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint. | ||
| CVE-2022-35652 | Med | 0.33 | 6.1 | 0.01 | Jul 25, 2022 | An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful… | ||
| CVE-2022-2252 | Med | 0.33 | 6.1 | 0.01 | Jun 29, 2022 | Open Redirect in GitHub repository microweber/microweber prior to 1.2.19. | ||
| CVE-2022-33146 | Med | 0.33 | 6.1 | 0.01 | Jun 27, 2022 | Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL. | ||
| CVE-2022-29718 | Med | 0.33 | 6.1 | 0.01 | Jun 2, 2022 | Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. | ||
| CVE-2022-29214 | Med | 0.33 | 6.1 | 0.01 | May 21, 2022 | NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability is present when the developer is implementing an OAuth 1 provider. Versions 3.29.3 and 4.3.3 contain a patch for this… | ||
| CVE-2022-24858 | Med | 0.33 | 6.1 | 0.01 | Apr 19, 2022 | next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks… | ||
| CVE-2022-27463 | Med | 0.33 | 6.1 | 0.01 | Apr 5, 2022 | Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. | ||
| CVE-2022-1233 | Med | 0.33 | 6.1 | 0.01 | Apr 4, 2022 | URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11. | ||
| CVE-2021-32478 | Med | 0.33 | 6.1 | 0.01 | Mar 11, 2022 | The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected. | ||
| CVE-2022-0697 | Med | 0.33 | 6.1 | 0.01 | Mar 6, 2022 | Open Redirect in GitHub repository archivy/archivy prior to 1.7.0. | ||
| CVE-2022-0868 | Med | 0.33 | 6.1 | 0.01 | Mar 6, 2022 | Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10. | ||
| CVE-2022-0869 | Med | 0.33 | 6.1 | 0.03 | Mar 6, 2022 | Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. | ||
| CVE-2022-0692 | Med | 0.33 | 6.1 | 0.03 | Feb 21, 2022 | Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1. | ||
| CVE-2022-0597 | Med | 0.33 | 6.1 | 0.03 | Feb 15, 2022 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. | ||
| CVE-2021-25033 | Med | 0.33 | 6.1 | 0.03 | Feb 14, 2022 | The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue | ||
| CVE-2022-0560 | Med | 0.33 | 6.1 | 0.01 | Feb 11, 2022 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. | ||
| CVE-2022-0235 | Med | 0.33 | 6.1 | 0.02 | Jan 16, 2022 | node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | ||
| CVE-2021-44528 | Med | 0.33 | 6.1 | 0.04 | Jan 10, 2022 | A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. | ||
| CVE-2022-0122 | Med | 0.33 | 6.1 | 0.01 | Jan 6, 2022 | forge is vulnerable to URL Redirection to Untrusted Site |
- risk 0.33cvss 6.1epss 0.02
In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.
- risk 0.33cvss 6.1epss 0.01
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful…
- risk 0.33cvss 6.1epss 0.01
Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
- risk 0.33cvss 6.1epss 0.01
Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
- risk 0.33cvss 6.1epss 0.01
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
- risk 0.33cvss 6.1epss 0.01
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability is present when the developer is implementing an OAuth 1 provider. Versions 3.29.3 and 4.3.3 contain a patch for this…
- risk 0.33cvss 6.1epss 0.01
next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks…
- risk 0.33cvss 6.1epss 0.01
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
- risk 0.33cvss 6.1epss 0.01
URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
- risk 0.33cvss 6.1epss 0.01
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.
- risk 0.33cvss 6.1epss 0.01
Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.
- risk 0.33cvss 6.1epss 0.01
Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
- risk 0.33cvss 6.1epss 0.03
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
- risk 0.33cvss 6.1epss 0.03
Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
- risk 0.33cvss 6.1epss 0.03
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
- risk 0.33cvss 6.1epss 0.03
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
- risk 0.33cvss 6.1epss 0.01
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
- risk 0.33cvss 6.1epss 0.02
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
- risk 0.33cvss 6.1epss 0.04
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
- risk 0.33cvss 6.1epss 0.01
forge is vulnerable to URL Redirection to Untrusted Site