CWE-601 指向未可信站点的URL重定向(开放重定向) 类弱点 886 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-601 属于开放重定向漏洞，指应用程序接受用户控制的输入并用于外部链接重定向。攻击者通常利用此缺陷构造恶意 URL，诱导用户点击以跳转至钓鱼或恶意网站，从而窃取凭证或传播恶意软件。开发者应避免直接使用用户输入作为重定向目标，需对目标域名进行白名单校验，或使用经过编码的内部标识符替代直接链接，确保重定向逻辑的安全可控。
$redirect_url = $_GET['url']; header("Location: " . $redirect_url);http://example.com/example.php?url=http://malicious.example.compublic class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-4037 | OAuth2 Proxy 输入验证错误漏洞 — OAuth2 Proxy | 4.3 | Medium | 2020-06-29 |
| CVE-2020-3337 | Cisco Umbrella 输入验证错误漏洞 — Cisco Umbrella | 6.1 | - | 2020-06-18 |
| CVE-2020-4048 | WordPress 输入验证错误漏洞 — wordpress-develop | 5.7 | Medium | 2020-06-12 |
| CVE-2020-5409 | Pivotal Software Concourse 输入验证错误漏洞 — Concourse | 6.1 | - | 2020-05-13 |
| CVE-2020-1997 | Palo Alto Networks PAN-OS 输入验证错误漏洞 — PAN-OS | 5.3 | Medium | 2020-05-13 |
| CVE-2020-11053 | OAuth2 Proxy 输入验证错误漏洞 — OAuth2 Proxy | 7.1 | High | 2020-05-07 |
| CVE-2020-3311 | Cisco Firepower Management Center 输入验证错误漏洞 — Cisco Firepower Management Center | 6.1 | - | 2020-05-06 |
| CVE-2020-3178 | Cisco Content Security Management Appliance 输入验证错误漏洞 — Cisco Content Security Management Appliance (SMA) | 6.1 | - | 2020-05-06 |
| CVE-2020-11034 | Teclib GLPI 输入验证错误漏洞 — GLPI | 6.1 | Medium | 2020-05-05 |
| CVE-2020-5337 | Dell EMC RSA Archer 输入验证错误漏洞 — RSA Archer | 4.6 | Medium | 2020-05-04 |
| CVE-2020-5270 | PrestaShop 输入验证错误漏洞 — PrestaShop | 4.1 | Medium | 2020-04-20 |
| CVE-2020-8143 | Revive Adserver 输入验证错误漏洞 — https://github.com/revive-adserver/revive-adserver | 6.1 | - | 2020-04-03 |
| CVE-2020-1927 | Apache HTTP Server 输入验证错误漏洞 — Apache HTTP Server | 6.1 | - | 2020-04-01 |
| CVE-2019-14882 | Moodle 输入验证错误漏洞 — moodle | 6.1 | - | 2020-03-18 |
| CVE-2020-6803 | WebThings Gateway 输入验证错误漏洞 — WebThings Gateway | 5.4 | Medium | 2020-02-28 |
| CVE-2019-19758 | Lenovo EZ Media & Backup Center 输入验证错误漏洞 — EZ Media & Backup Center ix2 | 6.1 | Medium | 2020-02-14 |
| CVE-2020-5233 | OAuth2 Proxy 输入验证错误漏洞 — OAuth2 Proxy | 5.9 | Medium | 2020-01-30 |
| CVE-2018-1002102 | Kubernetes 输入验证错误漏洞 — Kubernetes | 2.6 | Low | 2019-12-05 |
| CVE-2019-14857 | ZmartZone IAM mod_auth_openidc 输入验证错误漏洞 — mod_auth_openidc | 6.1 | - | 2019-11-26 |
| CVE-2019-15073 | Openfind Mail2000 输入验证错误漏洞 — MAIL2000 | 6.1 | - | 2019-11-20 |
| CVE-2019-10098 | Apache HTTP Server 输入验证错误漏洞 — Apache HTTP Server | 6.1 | - | 2019-09-25 |
| CVE-2019-13422 | floragunn Search Guard Kibana Plugin 输入验证错误漏洞 — Search Guard Kibana Plugin | 6.1 | - | 2019-08-23 |
| CVE-2019-1954 | Cisco WebEx Meetings Server 输入验证错误漏洞 — Cisco WebEx Meetings Server | 6.1 | - | 2019-08-08 |
| CVE-2019-1943 | Cisco Small Business 200、300和500 Switches 输入验证错误漏洞 — Cisco Small Business 300 Series Managed Switches | 6.1 | - | 2019-07-17 |
| CVE-2019-10133 | Moodle 输入验证错误漏洞 — moodle | 6.1 | - | 2019-06-26 |
| CVE-2019-11269 | Pivotal Software Spring Security OAuth 输入验证错误漏洞 — Spring Security OAuth | 5.4 | - | 2019-06-12 |
| CVE-2019-6741 | Samsung Galaxy S9 输入验证错误漏洞 — Galaxy S9 | 8.2 | - | 2019-06-03 |
| CVE-2019-5433 | Revive Adserver 输入验证错误漏洞 — Revive Adserver | 5.4 | - | 2019-05-06 |
| CVE-2019-3788 | Cloud Foundry UAA 输入验证错误漏洞 — UAA Release (OSS) | 6.1 | - | 2019-04-25 |
| CVE-2019-10955 | 多款Rockwell Automation产品输入验证错误漏洞 — MicroLogix 1400 Controllers | 6.1 | - | 2019-04-25 |
CWE-601（指向未可信站点的URL重定向(开放重定向)） 是常见的弱点类别，本平台收录该类弱点关联的 886 条 CVE 漏洞。