CWE-601 指向未可信站点的URL重定向(开放重定向) 类弱点 750 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-601 属于开放重定向漏洞，指应用程序接受用户控制的输入并用于外部链接重定向。攻击者通常利用此缺陷构造恶意 URL，诱导用户点击以跳转至钓鱼或恶意网站，从而窃取凭证或传播恶意软件。开发者应避免直接使用用户输入作为重定向目标，需对目标域名进行白名单校验，或使用经过编码的内部标识符替代直接链接，确保重定向逻辑的安全可控。
$redirect_url = $_GET['url']; header("Location: " . $redirect_url);http://example.com/example.php?url=http://malicious.example.compublic class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-5233 | OAuth2 Proxy 输入验证错误漏洞 — OAuth2 Proxy | 5.9 | Medium | 2020-01-30 |
| CVE-2018-1002102 | Kubernetes 输入验证错误漏洞 — Kubernetes | 2.6 | Low | 2019-12-05 |
| CVE-2019-14857 | ZmartZone IAM mod_auth_openidc 输入验证错误漏洞 — mod_auth_openidc | 6.1 | - | 2019-11-26 |
| CVE-2019-15073 | Openfind Mail2000 输入验证错误漏洞 — MAIL2000 | 6.1 | - | 2019-11-20 |
| CVE-2019-10098 | Apache HTTP Server 输入验证错误漏洞 — Apache HTTP Server | 6.1 | - | 2019-09-25 |
| CVE-2019-13422 | floragunn Search Guard Kibana Plugin 输入验证错误漏洞 — Search Guard Kibana Plugin | 6.1 | - | 2019-08-23 |
| CVE-2019-1954 | Cisco WebEx Meetings Server 输入验证错误漏洞 — Cisco WebEx Meetings Server | 6.1 | - | 2019-08-08 |
| CVE-2019-1943 | Cisco Small Business 200、300和500 Switches 输入验证错误漏洞 — Cisco Small Business 300 Series Managed Switches | 6.1 | - | 2019-07-17 |
| CVE-2019-10133 | Moodle 输入验证错误漏洞 — moodle | 6.1 | - | 2019-06-26 |
| CVE-2019-11269 | Pivotal Software Spring Security OAuth 输入验证错误漏洞 — Spring Security OAuth | 5.4 | - | 2019-06-12 |
| CVE-2019-6741 | Samsung Galaxy S9 输入验证错误漏洞 — Galaxy S9 | 8.2 | - | 2019-06-03 |
| CVE-2019-5433 | Revive Adserver 输入验证错误漏洞 — Revive Adserver | 5.4 | - | 2019-05-06 |
| CVE-2019-3788 | Cloud Foundry UAA 输入验证错误漏洞 — UAA Release (OSS) | 6.1 | - | 2019-04-25 |
| CVE-2019-10955 | 多款Rockwell Automation产品输入验证错误漏洞 — MicroLogix 1400 Controllers | 6.1 | - | 2019-04-25 |
| CVE-2019-3877 | mod_auth_mellon 输入验证错误漏洞 — mod_auth_mellon | 6.1 | - | 2019-03-27 |
| CVE-2019-3778 | Pivotal Software Pivotal Spring Security OAuth 输入验证错误漏洞 — Spring Security OAuth | 5.4 | - | 2019-03-07 |
| CVE-2019-3912 | LabKey Server 安全漏洞 — LabKey Server Community Edition | 6.1 | - | 2019-01-30 |
| CVE-2018-13813 | 多款Siemens产品安全漏洞 — SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) | 9.1 | - | 2018-12-13 |
| CVE-2018-14658 | Red Hat JBoss KeyCloak 安全漏洞 — keycloak | 6.1 | - | 2018-11-13 |
| CVE-2018-15403 | 多款Cisco产品安全漏洞 — Cisco Emergency Responder | 5.4 | - | 2018-10-05 |
| CVE-2017-16224 | st 输入验证错误漏洞 — st node module | 6.1 | - | 2018-06-07 |
| CVE-2018-3743 | hekto 安全漏洞 — hekto | 6.1 | - | 2018-06-01 |
| CVE-2018-3819 | Elasticsearch Kibana 安全漏洞 — Kibana | 4.7 | - | 2018-03-30 |
| CVE-2018-0097 | Cisco Prime Infrastructure 安全漏洞 — Cisco Prime Infrastructure | 6.1 | - | 2018-01-18 |
| CVE-2017-11482 | Elasticsearch Kibana 安全漏洞 — Kibana | 6.1 | - | 2017-12-08 |
| CVE-2017-1002150 | python-fedora 安全漏洞 — Python-Fedora | 6.1 | - | 2017-09-14 |
| CVE-2017-6018 | B.Braun Medical SpaceCom模块输入验证错误漏洞 — B. Braun Medical SpaceCom | 6.1 | - | 2017-06-30 |
| CVE-2016-10365 | Elasticsearch Kibana 安全漏洞 — Kibana | 6.1 | - | 2017-06-16 |
| CVE-2017-8451 | Elasticsearch Kibana 输入验证错误漏洞 — Elastic X-Pack Security | 6.1 | - | 2017-06-16 |
| CVE-2011-1594 | Red Hat Spacewalk 'url_bounce'跨站请求伪造漏洞 — Red Hat Enterprise Linux 6 | 6.5 | Medium | 2014-02-05 |
CWE-601（指向未可信站点的URL重定向(开放重定向)） 是常见的弱点类别，本平台收录该类弱点关联的 750 条 CVE 漏洞。