-
Type:
Bug
-
Status: Resolved
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: Core
-
Epic Link:
-
Tags:
-
Sprint:UI - 2024-5, UI COOLDOWN - 2024-5, UI - 2024-6
-
Story Points:2
MEDIUM - 1 Findings
CWE 601 URL Redirection to Untrusted Site ('Open Redirect')
Flaw Category: Insufficient Input Validation
Description: A web application accepts a untrusted input that specifies a link to an external site, and uses that link to generate a redirect. This enables phishing attacks.
Remediation: Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. Check the supplied URL against a whitelist of approved URLs or domains before redirecting.
Attached screenshot for the code details in Nuxeo Elements