Common Weakness Enumeration

CWE-601

Allowed

URL Redirection to Untrusted Site ('Open Redirect')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

2305 vulnerabilities reference this CWE, most recent first.

GHSA-58H4-9M7M-J9M4

Vulnerability from github – Published: 2023-01-09 20:06 – Updated: 2023-01-31 01:47
VLAI
Summary
@okta/oidc-middlewareOpen Redirect vulnerability
Details

An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

Affected products and versions Okta OIDC Middleware prior to version 5.0.0.

Resolution The vulnerability is fixed in OIDC Middleware 5.0.0. To remediate this vulnerability, upgrade Okta OIDC Middleware to this version or later.

CVE details CVE ID: CVE-2022-3145 Published Date: 01/05/2023 Vulnerability Type: Open Redirect CWE: CWE-601 CVSS v3.1 Score: 4.3 Severity: Medium Vector string: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Severity Details To exploit this issue, an attacker would need to send a victim a malformed URL containing a target server that they control. Once a user successfully completed the login process, the victim user would then be redirected to the attacker controlled site.

References https://github.com/okta/okta-oidc-middleware

Severity
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@okta/oidc-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-3145"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-09T20:06:02Z",
    "nvd_published_at": "2023-01-12T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.\n\n**Affected products and versions**\nOkta OIDC Middleware prior to version 5.0.0.\n\n**Resolution**\nThe vulnerability is fixed in OIDC Middleware 5.0.0.  To remediate this vulnerability, upgrade Okta OIDC Middleware to this version or later.\n\n**CVE details**\n**CVE ID:**\t\t[CVE-2022-3145](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-3145)\n**Published Date:**\t01/05/2023\n**Vulnerability Type:**\tOpen Redirect\n**CWE:**\t\t\tCWE-601\n**CVSS v3.1 Score:** 4.3\n**Severity:** Medium\n**Vector string:** AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\n\n**Severity Details**\nTo exploit this issue, an attacker would need to send a victim a malformed URL containing a target server that they control. Once a user successfully completed the login process, the victim user would then be redirected to the attacker controlled site.\n\n**References**\nhttps://github.com/okta/okta-oidc-middleware",
  "id": "GHSA-58h4-9m7m-j9m4",
  "modified": "2023-01-31T01:47:43Z",
  "published": "2023-01-09T20:06:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3145"
    },
    {
      "type": "WEB",
      "url": "https://github.com/okta/okta-oidc-middleware/commit/5d10b3ccdd5d6893de4d8b58696094267d30c113"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/okta/okta-oidc-middleware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@okta/oidc-middlewareOpen Redirect vulnerability"
}

GHSA-5923-R76V-MPRM

Vulnerability from github – Published: 2025-12-09 14:26 – Updated: 2025-12-10 15:46
VLAI
Summary
Open Redirect Vulnerability in Taguette
Details

Summary

An Open Redirect vulnerability exists in Taguette that allows attackers to craft malicious URLs that redirect users to arbitrary external websites after authentication. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware.

Severity: Medium to High

Details

The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. The vulnerable code is located in two places:

Location 1: Login Handler (taguette/web/views.py, lines 140-144)

def _go_to_next(self):
    next_ = self.get_argument('next', '')
    if not next_:
        next_ = self.reverse_url('index')
    return self.redirect(next_)  # ← No validation of next_ parameter

This method is called after successful login (line 132) and when an already-logged-in user visits the login page (line 109).

Location 2: Cookies Prompt Handler (taguette/web/views.py, lines 79-85)

def post(self):
    self.set_cookie('cookies_accepted', 'yes', dont_check=True)
    next_ = self.get_argument('next', '')
    if not next_:
        next_ = self.reverse_url('index')
    return self.redirect(next_)  # ← No validation of next_ parameter

In both cases, if next_ is provided by the user, it is passed directly to self.redirect() without checking whether it points to the same host or is a relative URL.

pic

PoC

Simply replace [your-taguette-instance] with your Taguette server domain and test these URLs in your browser:

Test 1: Cookies Prompt Redirect

https://[your-taguette-instance]/cookies?next=https://google.com
  1. Open the URL above in your browser
  2. Click "Accept cookies" button
  3. Result: You are redirected to https://google.com (external site)

Test 2: Login Redirect

https://[your-taguette-instance]/login?next=https://google.com
  1. Open the URL above in your browser
  2. Log in with valid credentials
  3. Result: You are redirected to https://google.com (external site)

Test 3: Already Logged In Redirect

https://[your-taguette-instance]/login?next=https://google.com
  1. First, log in to Taguette normally
  2. Then open the URL above
  3. Result: You are immediately redirected to https://google.com

Note: We use google.com as a safe external site for testing. In a real attack, this would be a phishing site.

Impact

  • Who is affected: All users of any Taguette instance running in multi-user mode
  • Attack vector: Social engineering / phishing via crafted URLs
  • Exploitability: Trivial - requires only crafting a URL with a malicious next parameter
  • Consequences:
  • Credential theft through phishing
  • Malware distribution
  • Session hijacking
  • Reputation damage to organizations running Taguette instances

The vulnerability is particularly dangerous because: 1. The login page displayed is completely legitimate, building victim trust 2. Users have just entered their credentials, making them more likely to enter them again on a fake "session expired" page 3. The trusted domain in the URL makes the attack more convincing

Recommended Fix

Validate that the next parameter is either a relative URL or points to the same host before redirecting.

Example Fix

Add a validation function:

from urllib.parse import urlparse

def is_safe_url(url, host):
    """Check if URL is safe for redirect (relative or same host)."""
    if not url:
        return False
    parsed = urlparse(url)
    # Reject protocol-relative URLs (//evil.com)
    if url.startswith('//'):
        return False
    # Allow relative URLs (no scheme and no netloc)
    if not parsed.scheme and not parsed.netloc:
        return True
    # Allow same-host URLs
    return parsed.netloc == host

Then update the vulnerable methods:

def _go_to_next(self):
    next_ = self.get_argument('next', '')
    if not next_ or not is_safe_url(next_, self.request.host):
        next_ = self.reverse_url('index')
    return self.redirect(next_)

Apply the same fix to the CookiesPrompt.post() method.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "taguette"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-67502"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-09T14:26:34Z",
    "nvd_published_at": "2025-12-10T00:16:11Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAn Open Redirect vulnerability exists in Taguette that allows attackers to craft malicious URLs that redirect users to arbitrary external websites after authentication. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware.\n\n**Severity:** Medium to High  \n\n---\n\n## Details\n\nThe application accepts a user-controlled `next` parameter and uses it directly in HTTP redirects without any validation. The vulnerable code is located in two places:\n\n### Location 1: Login Handler (`taguette/web/views.py`, lines 140-144)\n\n```python\ndef _go_to_next(self):\n    next_ = self.get_argument(\u0027next\u0027, \u0027\u0027)\n    if not next_:\n        next_ = self.reverse_url(\u0027index\u0027)\n    return self.redirect(next_)  # \u2190 No validation of next_ parameter\n```\n\nThis method is called after successful login (line 132) and when an already-logged-in user visits the login page (line 109).\n\n### Location 2: Cookies Prompt Handler (`taguette/web/views.py`, lines 79-85)\n\n```python\ndef post(self):\n    self.set_cookie(\u0027cookies_accepted\u0027, \u0027yes\u0027, dont_check=True)\n    next_ = self.get_argument(\u0027next\u0027, \u0027\u0027)\n    if not next_:\n        next_ = self.reverse_url(\u0027index\u0027)\n    return self.redirect(next_)  # \u2190 No validation of next_ parameter\n```\n\nIn both cases, if `next_` is provided by the user, it is passed directly to `self.redirect()` without checking whether it points to the same host or is a relative URL.\n\n---\n\n[![pic](https://github.com/user-attachments/assets/ac0afe1f-a8ac-4ac0-88f5-1c2cd092ca46)](url)\n\n\n## PoC\n\nSimply replace `[your-taguette-instance]` with your Taguette server domain and test these URLs in your browser:\n\n### Test 1: Cookies Prompt Redirect\n\n```\nhttps://[your-taguette-instance]/cookies?next=https://google.com\n```\n\n1. Open the URL above in your browser\n2. Click \"Accept cookies\" button\n3. **Result:** You are redirected to `https://google.com` (external site)\n\n### Test 2: Login Redirect\n\n```\nhttps://[your-taguette-instance]/login?next=https://google.com\n```\n\n1. Open the URL above in your browser\n2. Log in with valid credentials\n3. **Result:** You are redirected to `https://google.com` (external site)\n\n### Test 3: Already Logged In Redirect\n\n```\nhttps://[your-taguette-instance]/login?next=https://google.com\n```\n\n1. First, log in to Taguette normally\n2. Then open the URL above\n3. **Result:** You are immediately redirected to `https://google.com`\n\n\u003e **Note:** We use `google.com` as a safe external site for testing. In a real attack, this would be a phishing site.\n\n---\n\n## Impact\n\n- **Who is affected:** All users of any Taguette instance running in multi-user mode\n- **Attack vector:** Social engineering / phishing via crafted URLs\n- **Exploitability:** Trivial - requires only crafting a URL with a malicious `next` parameter\n- **Consequences:**\n  - Credential theft through phishing\n  - Malware distribution\n  - Session hijacking\n  - Reputation damage to organizations running Taguette instances\n\nThe vulnerability is particularly dangerous because:\n1. The login page displayed is completely legitimate, building victim trust\n2. Users have just entered their credentials, making them more likely to enter them again on a fake \"session expired\" page\n3. The trusted domain in the URL makes the attack more convincing\n\n---\n\n## Recommended Fix\n\nValidate that the `next` parameter is either a relative URL or points to the same host before redirecting.\n\n### Example Fix\n\nAdd a validation function:\n\n```python\nfrom urllib.parse import urlparse\n\ndef is_safe_url(url, host):\n    \"\"\"Check if URL is safe for redirect (relative or same host).\"\"\"\n    if not url:\n        return False\n    parsed = urlparse(url)\n    # Reject protocol-relative URLs (//evil.com)\n    if url.startswith(\u0027//\u0027):\n        return False\n    # Allow relative URLs (no scheme and no netloc)\n    if not parsed.scheme and not parsed.netloc:\n        return True\n    # Allow same-host URLs\n    return parsed.netloc == host\n```\n\nThen update the vulnerable methods:\n\n```python\ndef _go_to_next(self):\n    next_ = self.get_argument(\u0027next\u0027, \u0027\u0027)\n    if not next_ or not is_safe_url(next_, self.request.host):\n        next_ = self.reverse_url(\u0027index\u0027)\n    return self.redirect(next_)\n```\n\nApply the same fix to the `CookiesPrompt.post()` method.\n\n---",
  "id": "GHSA-5923-r76v-mprm",
  "modified": "2025-12-10T15:46:45Z",
  "published": "2025-12-09T14:26:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/remram44/taguette/security/advisories/GHSA-5923-r76v-mprm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67502"
    },
    {
      "type": "WEB",
      "url": "https://github.com/remram44/taguette/commit/67de2d2612e7e2572c61cd9627f89c2bfd0f2a36"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/remram44/taguette"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open Redirect Vulnerability in Taguette"
}

GHSA-595P-PFPQ-RPWW

Vulnerability from github – Published: 2026-04-27 18:32 – Updated: 2026-04-27 18:32
VLAI
Details

An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-30346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-27T17:16:42Z",
    "severity": "MODERATE"
  },
  "details": "An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL.",
  "id": "GHSA-595p-pfpq-rpww",
  "modified": "2026-04-27T18:32:08Z",
  "published": "2026-04-27T18:32:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30346"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/syphonetic/d4e519904aaa55dbd0e3b87a317660d1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hunvreus/devpush"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hunvreus/devpush/releases/tag/0.3.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59FQ-727J-HM3F

Vulnerability from github – Published: 2023-03-02 23:21 – Updated: 2023-04-04 21:47
VLAI
Summary
keycloak-connect contains Open redirect vulnerability in the Node.js adapter
Details

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none.

Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "keycloak-connect"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-2237"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-02T23:21:02Z",
    "nvd_published_at": "2023-03-27T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using `checkSSO` with query param `prompt=none`.",
  "id": "GHSA-59fq-727j-hm3f",
  "modified": "2023-04-04T21:47:30Z",
  "published": "2023-03-02T23:21:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2237"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2097007"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak-nodejs-connect"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "keycloak-connect contains Open redirect vulnerability in the Node.js adapter"
}

GHSA-59P7-VRRG-MX39

Vulnerability from github – Published: 2022-05-19 00:00 – Updated: 2022-05-27 00:01
VLAI
Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.

Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-1774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-18T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.",
  "id": "GHSA-59p7-vrrg-mx39",
  "modified": "2022-05-27T00:01:10Z",
  "published": "2022-05-19T00:00:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1774"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/6ac07c49-bb7f-47b5-b361-33e6757b8757"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5C7G-5XJ5-GPX3

Vulnerability from github – Published: 2025-03-13 12:30 – Updated: 2025-03-13 12:30
VLAI
Details

Dell NetWorker, 19.11.0.3 and below versions, contain(s) an Open Redirect Vulnerability in NMC. An unauthenticated attacker with remoter access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-21104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-13T12:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Dell NetWorker, 19.11.0.3 and below versions, contain(s) an Open Redirect Vulnerability in NMC. An unauthenticated attacker with remoter access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.",
  "id": "GHSA-5c7g-5xj5-gpx3",
  "modified": "2025-03-13T12:30:32Z",
  "published": "2025-03-13T12:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21104"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000294392/dsa-2025-124-security-update-for-dell-networker-management-console-for-http-host-header-injection-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5CFF-VFPF-QQ5F

Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34
VLAI
Details

Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-28726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-24T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.",
  "id": "GHSA-5cff-vfpf-qq5f",
  "modified": "2022-05-24T17:34:54Z",
  "published": "2022-05-24T17:34:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28726"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/p/seeddms/code/ci/877844cbba0749367b8ba0e4e0bde34a1dc838f1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-5CQ4-PP95-GVQJ

Vulnerability from github – Published: 2025-07-23 12:30 – Updated: 2026-06-05 18:31
VLAI
Details

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.This issue affects B2B: before 04.06.2025.

Severity
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-4296"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-23T12:15:27Z",
    "severity": "MODERATE"
  },
  "details": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in HotelRunner B2B allows Forceful Browsing.This issue affects B2B: before 04.06.2025.",
  "id": "GHSA-5cq4-pp95-gvqj",
  "modified": "2026-06-05T18:31:31Z",
  "published": "2025-07-23T12:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4296"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0169"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-25-0169"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5CVC-V5HP-8486

Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2023-02-03 21:30
VLAI
Details

IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 158517.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-4153"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-25T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 158517.",
  "id": "GHSA-5cvc-v5hp-8486",
  "modified": "2023-02-03T21:30:28Z",
  "published": "2022-05-24T16:48:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4153"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158517"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10888379"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5F97-9CGP-7WQG

Vulnerability from github – Published: 2025-07-15 21:31 – Updated: 2025-07-15 21:31
VLAI
Details

Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Express. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

Severity
9.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-50067"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-15T20:15:41Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerability in Oracle Application Express (component: Strategic Planner Starter App).  Supported versions that are affected are 24.2.4 and  24.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Express. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).",
  "id": "GHSA-5f97-9cgp-7wqg",
  "modified": "2025-07-15T21:31:40Z",
  "published": "2025-07-15T21:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50067"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2025.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • Use a list of approved URLs or domains to be used for redirection.
Mitigation
Architecture and Design

Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.

Mitigation MIT-21.2
Architecture and Design

Strategy: Enforcement by Conversion

  • When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
  • For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Architecture and Design

Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).

Mitigation MIT-6
Architecture and Design Implementation

Strategy: Attack Surface Reduction

  • Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
  • Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

CAPEC-178: Cross-Site Flashing

An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.

← Back to the CWE list