1345
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP4 Unchecked Status Condition
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Weakness ID : 601
Structure : Simple
Abstraction : Base
Description
A web application accepts a user-controlled input that specifies a link to an external site, and uses
that link in a Redirect. This simplifies phishing attacks.
Extended Description
An http parameter may contain a URL value and could cause the web application to redirect the
request to the specified URL. By modifying the URL value to a malicious site, an attacker may
successfully launch a phishing scam and steal user credentials. Because the server name in the
modified link is identical to the original site, phishing attempts have a more trustworthy appearance.
Whether this issue poses a vulnerability will be subject to the intended behavior of the application.
For example, a search engine might intentionally provide redirects to arbitrary URLs.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 610 Externally Controlled Reference to a Resource in Another
Sphere