CWE-601 指向未可信站点的URL重定向(开放重定向) 类弱点 963 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-601 属于开放重定向漏洞，指应用程序接受用户控制的输入并用于外部链接重定向。攻击者通常利用此缺陷构造恶意 URL，诱导用户点击以跳转至钓鱼或恶意网站，从而窃取凭证或传播恶意软件。开发者应避免直接使用用户输入作为重定向目标，需对目标域名进行白名单校验，或使用经过编码的内部标识符替代直接链接，确保重定向逻辑的安全可控。
$redirect_url = $_GET['url']; header("Location: " . $redirect_url);http://example.com/example.php?url=http://malicious.example.compublic class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-22873 | Revive Adserver 输入验证错误漏洞 — https://github.com/revive-adserver/revive-adserver | 6.1 | - | 2021-01-21 |
| CVE-2021-1218 | Cisco Smart Software Manager 输入验证错误漏洞 — Cisco Smart Software Manager On-Prem | 5.4 | - | 2021-01-20 |
| CVE-2021-1310 | Cisco Webex Meetings 输入验证错误漏洞 — Cisco Webex Meetings | 4.7 | Medium | 2021-01-13 |
| CVE-2020-29498 | Dell Wyse Management Suite 输入验证错误漏洞 — Wyse Management Suite | 6.1 | - | 2021-01-04 |
| CVE-2020-26275 | Jupyter Server 输入验证错误漏洞 — jupyter_server | 6.1 | Medium | 2020-12-21 |
| CVE-2020-27816 | Red Hat OpenShift Elasticsearch-operator 输入验证错误漏洞 — openshift-logging/console | 6.1 | - | 2020-12-02 |
| CVE-2020-26232 | Jupyter Server 输入验证错误漏洞 — jupyter_server | 4.1 | Medium | 2020-11-24 |
| CVE-2020-26215 | Jupyter Notebook 输入验证错误漏洞 — notebook | 4.4 | Medium | 2020-11-18 |
| CVE-2020-26219 | Puncsky Touchbase.ai 输入验证错误漏洞 — touchbase.ai | 4.7 | Medium | 2020-11-11 |
| CVE-2020-3558 | Cisco Firepower Management Center 输入验证错误漏洞 — Cisco Firepower Management Center | 4.7 | Medium | 2020-10-21 |
| CVE-2020-24551 | TDCX IProom MMC+ Server 输入验证错误漏洞 — MMC+ Server | 6.1 | Medium | 2020-10-14 |
| CVE-2020-15241 | TYPO3 跨站脚本漏洞 — Fluid | 4.7 | Medium | 2020-10-08 |
| CVE-2020-15242 | ZEIT Next.js 输入验证错误漏洞 — next.js | 4.7 | Medium | 2020-10-08 |
| CVE-2019-15974 | Cisco Managed Services Accelerator 输入验证错误漏洞 — Cisco Managed Services Accelerator | 6.1 | - | 2020-09-23 |
| CVE-2020-15129 | Containous Traefik 输入验证错误漏洞 — traefik | 6.1 | Medium | 2020-07-30 |
| CVE-2020-7520 | Schneider Electric Software Update 输入验证错误漏洞 — Schneider Electric Software Update (SESU) V2.4.0 and prior. | 4.0 | - | 2020-07-23 |
| CVE-2020-8559 | Kubernetes kube-apiserver 输入验证错误漏洞 — Kubernetes | 6.4 | Medium | 2020-07-22 |
| CVE-2020-4037 | OAuth2 Proxy 输入验证错误漏洞 — OAuth2 Proxy | 4.3 | Medium | 2020-06-29 |
| CVE-2020-3337 | Cisco Umbrella 输入验证错误漏洞 — Cisco Umbrella | 6.1 | - | 2020-06-18 |
| CVE-2020-4048 | WordPress 输入验证错误漏洞 — wordpress-develop | 5.7 | Medium | 2020-06-12 |
| CVE-2020-5409 | Pivotal Software Concourse 输入验证错误漏洞 — Concourse | 6.1 | - | 2020-05-13 |
| CVE-2020-1997 | Palo Alto Networks PAN-OS 输入验证错误漏洞 — PAN-OS | 5.3 | Medium | 2020-05-13 |
| CVE-2020-11053 | OAuth2 Proxy 输入验证错误漏洞 — OAuth2 Proxy | 7.1 | High | 2020-05-07 |
| CVE-2020-3311 | Cisco Firepower Management Center 输入验证错误漏洞 — Cisco Firepower Management Center | 6.1 | - | 2020-05-06 |
| CVE-2020-3178 | Cisco Content Security Management Appliance 输入验证错误漏洞 — Cisco Content Security Management Appliance (SMA) | 6.1 | - | 2020-05-06 |
| CVE-2020-11034 | Teclib GLPI 输入验证错误漏洞 — GLPI | 6.1 | Medium | 2020-05-05 |
| CVE-2020-5337 | Dell EMC RSA Archer 输入验证错误漏洞 — RSA Archer | 4.6 | Medium | 2020-05-04 |
| CVE-2020-5270 | PrestaShop 输入验证错误漏洞 — PrestaShop | 4.1 | Medium | 2020-04-20 |
| CVE-2020-8143 | Revive Adserver 输入验证错误漏洞 — https://github.com/revive-adserver/revive-adserver | 6.1 | - | 2020-04-03 |
| CVE-2020-1927 | Apache HTTP Server 输入验证错误漏洞 — Apache HTTP Server | 6.1 | - | 2020-04-01 |
CWE-601（指向未可信站点的URL重定向(开放重定向)） 是常见的弱点类别，本平台收录该类弱点关联的 963 条 CVE 漏洞。