"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" falls under "A01:2025 Broken Access Control"
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 6.1k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
Hi!
Right now (and in 2021 too) CWE-601 - URL Redirection to Untrusted Site ('Open Redirect') is mapped to A01:2025 Broken Access Control. It seems to me that this is an error. The OWASP website states the following:
Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of all data, or performing a business function outside the user's limits.
An open redirect vulnerability does not allow users to act outside of their intended permissions. Generally, the user is routed to a completely different site and the first site's permissions do not apply.
I think that CWE-601 is better categorized under A05:2025 Injection.
Thanks!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked OWASP A01:2025 page and compare its stated scope with the issue's CWE-601 mapping. No repository file or test is named, so locate the source for this classification only after maintainers decide whether the mapping should change; done means an agreed categorization is reflected in the relevant Top 10 content.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100