156 – Uncontrolled external site redirect
Description
Redirects made by the application are not controlled and could be manipulated by an attacker.
Impact
Redirect users to sites controlled by an attacker.
Recommendation
Use predefined parameters and not information that can be manipulated by the user for redirection to web sites in the application.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: A
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X