CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

92 vulnerabilities with CWE-441
CVE-2025-48545 HIGH
Android - Local Privilege Escalation via AccountManagerService Confused Deputy
CVSS 7.1
CVE-2025-48532 HIGH
markMediaAsFavorite - Privilege Escalation
CVSS 7.3
CVE-2025-48529 MEDIUM
VoicemailNotificationSettingsUtil - Info Disclosure
CVSS 5.5
CVE-2025-32346 HIGH
VoicemailSettingsActivity - Privilege Escalation
CVSS 7.8
CVE-2025-32326 HIGH
AppRestrictionsFragment - Privilege Escalation
CVSS 7.8
CVE-2025-32324 HIGH
Android - Unintended Proxy or Intermediary in ActivityManagerShellCommand
CVSS 7.8
CVE-2025-32321 HIGH
Android - Local Privilege Escalation via Confused Deputy in AccountTypePreferenceLoader
CVSS 7.8
CVE-2025-26454 HIGH
Android - Local Privilege Escalation via DisclaimersParserImpl Confused Deputy
CVSS 7.8
CVE-2025-22441 HIGH
Android - Local Privilege Escalation via RemoteViews Confused Deputy
CVSS 7.3
CVE-2025-26452 HIGH
Android - Local Privilege Escalation via Confused Deputy in ResourcesImpl
CVSS 7.8
CVE-2025-22418 HIGH
Multiple Locations - Privilege Escalation
CVSS 7.8
CVE-2025-22416 HIGH
Android - Unintended Proxy or Intermediary in ChooserActivity
CVSS 7.8
CVE-2025-48710 MEDIUM
kro 0.1.0-0.2.1 - Attacker-Controlled Container Image Execution
CVSS 4.1
CVE-2025-47269 HIGH
code-server < 4.99.4 - Unintended Proxy via Malicious URL
CVSS 8.3
CVE-2025-25061 MEDIUM
HMI ViewJet/HMI GC-A2 - Info Disclosure
CVSS 5.8
CVE-2025-25306 CRITICAL
Misskey < 2025.2.1 - Unintended Proxy via ActivityPub Object Field Validation Bypass
CVSS 9.3
CVE-2025-23217 HIGH
mitmproxy < 11.1.2 - Server-Side Request Forgery via Proxy to Internal API
CVE-2024-9870 MEDIUM
GitLab 15.11-17.6.5, 17.7-17.7.4, 17.8-17.8.2 - Server-Side Request Forgery
CVSS 4.3
CVE-2024-30128 HIGH
HCL Nomad Server on Domino - Open Proxy IP Masking
CVSS 8.6
CVE-2024-31319 HIGH
Android - Local Privilege Escalation via Notification Channel Update Confused Deputy
CVSS 7.8
CVE-2024-34068 MEDIUM
Pterodactyl Panel <1.11.2 - Auth Bypass
CVSS 6.4
CVE-2023-31313 HIGH
AMD PMFW - Privileged SMU Message Arbitrary Code Execution
CVSS 7.2
CVE-2023-40111 HIGH
Android - Local Privilege Escalation via MediaSessionRecord Confused Deputy
CVSS 7.8
CVE-2023-33188 MEDIUM
Omni-notes < 6.2.6 - Unintended File Copy via Insufficient Path Validation
CVSS 6.3
CVE-2023-21082 MEDIUM
Android - Local Information Disclosure via Confused Deputy in NewOutgoingCallIntentBroadcaster
CVSS 5.5
Details
Vulnerabilities 92