CWE-601
AllowedURL Redirection to Untrusted Site ('Open Redirect')
Abstraction: Base · Status: Draft
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
2306 vulnerabilities reference this CWE, most recent first.
GHSA-R2G7-3VF5-29CP
Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2024-04-04 01:12Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing attacks via the process of login.
{
"affected": [],
"aliases": [
"CVE-2019-5969"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-05T14:15:00Z",
"severity": "MODERATE"
},
"details": "Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing attacks via the process of login.",
"id": "GHSA-r2g7-3vf5-29cp",
"modified": "2024-04-04T01:12:11Z",
"published": "2022-05-24T16:49:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5969"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN84876282/index.html"
},
{
"type": "WEB",
"url": "https://weseek.co.jp/security/2019/06/04/growi-fix-jvn84876282"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R2V5-26V2-6CC4
Vulnerability from github – Published: 2023-02-12 06:30 – Updated: 2023-02-21 18:30An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
{
"affected": [],
"aliases": [
"CVE-2022-38657"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-12T04:15:00Z",
"severity": "MODERATE"
},
"details": "An open redirect to malicious sites can occur when accessing the \"Feedback\" action on the manager page.",
"id": "GHSA-r2v5-26v2-6cc4",
"modified": "2023-02-21T18:30:17Z",
"published": "2023-02-12T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38657"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0097201"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R2WF-P4VH-GW33
Vulnerability from github – Published: 2022-05-17 02:43 – Updated: 2022-05-17 02:43An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter.
{
"affected": [],
"aliases": [
"CVE-2017-7343"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-27T00:29:00Z",
"severity": "MODERATE"
},
"details": "An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter.",
"id": "GHSA-r2wf-p4vh-gw33",
"modified": "2022-05-17T02:43:14Z",
"published": "2022-05-17T02:43:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7343"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-17-114"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R3CH-GWJW-G759
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08, 2020.11, 2021.05. The vulnerability could allow redirect users to malicious websites after authentication.
{
"affected": [],
"aliases": [
"CVE-2021-38123"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-07T17:15:00Z",
"severity": "MODERATE"
},
"details": "Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08, 2020.11, 2021.05. The vulnerability could allow redirect users to malicious websites after authentication.",
"id": "GHSA-r3ch-gwjw-g759",
"modified": "2022-05-24T19:13:08Z",
"published": "2022-05-24T19:13:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38123"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000001673"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R3QR-VWVG-43F7
Vulnerability from github – Published: 2022-11-30 21:22 – Updated: 2022-12-03 04:10Description Prior to Opencast 12.5 Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users.
Impact The vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues.
Patches This issue is fixed in Opencast 12.5 and newer
References Patch fixing the issue
If you have any questions or comments about this advisory: Open an issue in our issue tracker Email us at security@opencast.org
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.opencastproject:opencast-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41965"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-30T21:22:23Z",
"nvd_published_at": "2022-11-28T21:15:00Z",
"severity": "MODERATE"
},
"details": "**Description**\nPrior to Opencast 12.5 Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users.\n\n**Impact**\nThe vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues.\n\n**Patches**\nThis issue is fixed in Opencast 12.5 and newer\n\n**References**\n[Patch fixing the issue](https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017)\n\n**If you have any questions or comments about this advisory**:\nOpen an issue in [our issue tracker](https://github.com/opencast/opencast/issues)\nEmail us at [security@opencast.org](mailto:security@opencast.org)",
"id": "GHSA-r3qr-vwvg-43f7",
"modified": "2022-12-03T04:10:07Z",
"published": "2022-11-30T21:22:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41965"
},
{
"type": "WEB",
"url": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
},
{
"type": "PACKAGE",
"url": "https://github.com/opencast/opencast"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Authenticated OpenRedirect Vulnerability"
}
GHSA-R3VJ-4PQV-MMHX
Vulnerability from github – Published: 2022-05-14 01:41 – Updated: 2022-05-14 01:41Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2018-16174"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-09T23:29:00Z",
"severity": "MODERATE"
},
"details": "Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.",
"id": "GHSA-r3vj-4pqv-mmhx",
"modified": "2022-05-14T01:41:34Z",
"published": "2022-05-14T01:41:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16174"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN85760090/index.html"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/learnpress"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R3WX-Q354-FC7X
Vulnerability from github – Published: 2022-05-17 02:34 – Updated: 2022-05-17 02:34A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.1(7)ER1.
{
"affected": [],
"aliases": [
"CVE-2017-6670"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-13T06:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.1(7)ER1.",
"id": "GHSA-r3wx-q354-fc7x",
"modified": "2022-05-17T02:34:27Z",
"published": "2022-05-17T02:34:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6670"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-cucm1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98946"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038631"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R42C-W8Q9-FF4G
Vulnerability from github – Published: 2025-05-06 09:31 – Updated: 2025-05-06 09:31A vulnerability was found in fp2952 spring-cloud-base up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa. It has been declared as problematic. Affected by this vulnerability is the function sendBack of the file /spring-cloud-base-master/auth-center/auth-center-provider/src/main/java/com/peng/auth/provider/config/web/MvcController.java of the component HTTP Header Handler. The manipulation of the argument Referer leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
{
"affected": [],
"aliases": [
"CVE-2025-4328"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T07:15:48Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in fp2952 spring-cloud-base up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa. It has been declared as problematic. Affected by this vulnerability is the function sendBack of the file /spring-cloud-base-master/auth-center/auth-center-provider/src/main/java/com/peng/auth/provider/config/web/MvcController.java of the component HTTP Header Handler. The manipulation of the argument Referer leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.",
"id": "GHSA-r42c-w8q9-ff4g",
"modified": "2025-05-06T09:31:31Z",
"published": "2025-05-06T09:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4328"
},
{
"type": "WEB",
"url": "https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250423-01.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307429"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307429"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.564161"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R433-3RC5-GP93
Vulnerability from github – Published: 2022-05-14 01:33 – Updated: 2022-05-14 01:33Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
{
"affected": [],
"aliases": [
"CVE-2019-5915"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-13T18:29:00Z",
"severity": "MODERATE"
},
"details": "Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.",
"id": "GHSA-r433-3rc5-gp93",
"modified": "2022-05-14T01:33:59Z",
"published": "2022-05-14T01:33:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5915"
},
{
"type": "WEB",
"url": "https://www.cs.themistruct.com"
},
{
"type": "WEB",
"url": "https://www.osstech.co.jp/support/am2019-1-1"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN43193964/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R43R-4M97-HPP9
Vulnerability from github – Published: 2024-04-10 21:30 – Updated: 2024-07-03 18:34An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to control the "back" parameter in the URL through a double encoded URL.
{
"affected": [],
"aliases": [
"CVE-2024-28344"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T19:15:49Z",
"severity": "LOW"
},
"details": "An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to control the \"back\" parameter in the URL through a double encoded URL.",
"id": "GHSA-r43r-4m97-hpp9",
"modified": "2024-07-03T18:34:14Z",
"published": "2024-04-10T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28344"
},
{
"type": "WEB",
"url": "https://securitycafe.ro/2024/03/21/cve-2024-28344-cve-2024-28345-in-sipwise-c5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Use a list of approved URLs or domains to be used for redirection.
Mitigation
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Mitigation MIT-21.2
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Mitigation MIT-6
Strategy: Attack Surface Reduction
- Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
- Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-178: Cross-Site Flashing
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.