1366
formatted e-mail directing the user to log into their account by including in the e-mail the following
link:
Example Language: HTML (Attack)
<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>
The user may assume that the link is safe since the URL starts with their trusted bank,
bank.example.com. However, the user will then be redirected to the attacker's web site
(attacker.example.net) which the attacker may have made to appear very similar to
bank.example.com. The user may then unwittingly enter credentials into the attacker's web page
and compromise their bank account. A Java servlet should never redirect a user to a URL without
verifying that the redirect address is a trusted site.
Observed Examples
Reference Description
CVE-2022-3032 An email client does not block loading of remote objects in a nested document.
https://www.cve.org/CVERecord?id=CVE-2022-3032
CVE-2022-45918 Chain: a learning management tool debugger uses external input to locate
previous session logs (CWE-73) and does not properly validate the given
path (CWE-20), allowing for filesystem path traversal using "../" sequences
(CWE-24)
https://www.cve.org/CVERecord?id=CVE-2022-45918
CVE-2018-1000613Cryptography API uses unsafe reflection when deserializing a private key
https://www.cve.org/CVERecord?id=CVE-2018-1000613
CVE-2020-11053 Chain: Go-based Oauth2 reverse proxy can send the authenticated user to
another site at the end of the authentication flow. A redirect URL with HTMLencoded
whitespace characters can bypass the validation (CWE-1289) to
redirect to a malicious site (CWE-601)
https://www.cve.org/CVERecord?id=CVE-2020-11053
CVE-2022-42745 Recruiter software allows reading arbitrary files using XXE
https://www.cve.org/CVERecord?id=CVE-2022-42745
CVE-2004-2331 Database system allows attackers to bypass sandbox restrictions by using the
Reflection API.
https://www.cve.org/CVERecord?id=CVE-2004-2331
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 980 SFP Secondary Cluster: Link in Resource Name
Resolution
888 2409
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
This is a general class of weakness, but most research is focused on more specialized cases,
such as path traversal (CWE-22) and symlink following (CWE-61). A symbolic link has a name;
CWE Version 4.14
CWE-611: Improper Restriction of XML External Entity Reference
CWE-611: Improper Restriction of XML External Entity Reference