CWE-601— URL Redirection to Untrusted Site (Open Redirect)

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.— MITRE CWE catalog

1,916 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-601page 23 of 39

CVE-2019-8995MEDIUMCVSS 6.1EG 6.1
2019-04-24
The workspace client, openspace client, and app development client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain a…
CVE-2018-20698MEDIUMCVSS 6.1EG 6.1
2019-04-09
The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set.
CVE-2019-11016MEDIUMCVSS 6.1EG 6.1
2019-04-08
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
CVE-2019-10856MEDIUMCVSS 6.1EG 6.1
2019-04-04
In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255.
CVE-2018-15180MEDIUMCVSS 6.1EG 6.1
2019-04-02
qTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform redirect parameter.
CVE-2017-18109MEDIUMCVSS 6.1EG 6.1
2019-03-29
The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack v…
CVE-2019-10255MEDIUMCVSS 6.1EG 6.1
2019-03-28
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successfu…
CVE-2019-9915MEDIUMCVSS 6.1EG 6.1
2019-03-22
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.
CVE-2019-9837MEDIUMCVSS 6.1EG 6.1
2019-03-21
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid…
CVE-2019-7416MEDIUMCVSS 6.1EG 6.1
2019-03-21
XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/help/en/default.htm" is vulnerable.
CVE-2018-17422MEDIUMCVSS 6.1EG 6.1
2019-03-07
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.
CVE-2018-19106MEDIUMCVSS 6.1EG 6.1
2019-02-20
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959.
CVE-2016-10742MEDIUMCVSS 6.1EG 6.1
2019-02-17
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.
CVE-2019-5915MEDIUMCVSS 6.1EG 6.1
2019-02-13
Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
CVE-2019-3912MEDIUMCVSS 6.1EG 6.1
2019-01-30
An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.
CVE-2019-6780MEDIUMCVSS 6.1EG 6.1
2019-01-24
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.
CVE-2018-16191MEDIUMCVSS 6.1EG 6.1
2019-01-09
Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, E…
CVE-2018-16174MEDIUMCVSS 6.1EG 6.1
2019-01-09
Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2018-0688MEDIUMCVSS 6.1EG 6.1
2019-01-09
Open redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions released prior to 2018 March 13, EP-10VA firmware versions released prior to 2017 Septem…
CVE-2018-19790MEDIUMCVSS 6.1EG 6.1
2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms,…
CVE-2018-7804MEDIUMCVSS 6.1EG 6.1
2018-12-17
A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be redirected to a URL of the attacker's c…
CVE-2018-7797MEDIUMCVSS 6.1EG 6.1
2018-12-17
A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure Energy Expert 1.3 (formerly Power Manager), EcoStruxure …
CVE-2018-19796MEDIUMCVSS 6.1EG 6.1
2018-12-03
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter.
CVE-2018-11067MEDIUMCVSS 6.1EG 6.1
2018-11-26
Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection v…
CVE-2018-17948MEDIUMCVSS 6.1EG 6.1
2018-11-20
An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3.
CVE-2018-2476MEDIUMCVSS 6.1EG 6.1
2018-11-13
Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site.
CVE-2018-14658MEDIUMCVSS 6.1EG 6.1
2018-11-13
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
CVE-2018-13402MEDIUMCVSS 6.1EG 6.1
2018-10-23
Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.…
CVE-2018-13401MEDIUMCVSS 6.1EG 6.1
2018-10-23
The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from…
CVE-2018-12675MEDIUMCVSS 6.1EG 6.1
2018-10-19
The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpect…
CVE-2018-15493MEDIUMCVSS 6.1EG 6.1
2018-10-17
vBulletin 5.4.3 has an Open Redirect.
CVE-2018-17870MEDIUMCVSS 6.1EG 6.1
2018-10-01
An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of account_change.php is vulnerable to an open redirect, a different vulnerability than CVE-2018-15683.
CVE-2018-16954MEDIUMCVSS 6.1EG 6.1
2018-09-18
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the portal is vulnerable to insecure redirection (also called an open redirect). The in_hi_redirect parameter is not validated by the application …
CVE-2018-17074MEDIUMCVSS 6.1EG 6.1
2018-09-16
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.
CVE-2018-5548MEDIUMCVSS 6.1EG 6.1
2018-09-13
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using diffe…
CVE-2018-16761MEDIUMCVSS 6.1EG 6.1
2018-09-09
Eventum before 3.4.0 has an open redirect vulnerability.
CVE-2018-14398MEDIUMCVSS 6.1EG 6.1
2018-09-07
An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake login page in order to steal credentials.
CVE-2018-14366MEDIUMCVSS 6.1EG 6.1
2018-09-06
download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability.
CVE-2018-1000671MEDIUMCVSS 6.1EG 6.1
2018-09-06
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via dat…
CVE-2018-15683MEDIUMCVSS 6.1EG 6.1
2018-09-05
An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected.
CVE-2018-7692MEDIUMCVSS 6.1EG 6.1
2018-08-09
Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1.
CVE-2018-15178MEDIUMCVSS 6.1EG 6.1
2018-08-08
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isVal…
CVE-2018-7091MEDIUMCVSS 6.1EG 6.1
2018-08-06
HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr and RepMgr.
CVE-2018-14574MEDIUMCVSS 6.1EG 6.1
2018-08-03
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
CVE-2018-14474MEDIUMCVSS 6.1EG 6.1
2018-07-20
views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.
CVE-2018-14381MEDIUMCVSS 6.1EG 6.1
2018-07-18
Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.
CVE-2013-0594MEDIUMCVSS 6.1EG 6.1
2018-07-11
Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 83383.
CVE-2018-1355MEDIUMCVSS 6.1EG 6.1
2018-06-27
An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiVi…
CVE-2018-11041MEDIUMCVSS 6.1EG 6.1
2018-06-25
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for in…
CVE-2018-11408MEDIUMCVSS 6.1EG 6.1
2018-06-13
The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlin…

Map vulnerabilities like CWE-601 to your infrastructure

EchelonGraph correlates every CVE — across CWE-601 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →