CWE-918 服务端请求伪造(SSRF) 类弱点 1696 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-27271 | SAP BusinessObjects Business Intelligence Platform 代码问题漏洞 — BusinessObjects Business Intelligence Platform (Web Services) | 6.5 | Medium | 2023-03-14 |
| CVE-2023-26459 | SAP NetWeaver AS 代码问题漏洞 — NetWeaver AS for ABAP and ABAP Platform | 7.4 | High | 2023-03-14 |
| CVE-2021-36396 | Moodle 代码问题漏洞 — Moodle | 7.5 | - | 2023-03-06 |
| CVE-2023-26492 | Directus 代码问题漏洞 — directus | 5.0 | Medium | 2023-03-03 |
| CVE-2023-1046 | MuYuCMS 代码问题漏洞 — MuYuCMS | 6.3 | Medium | 2023-02-26 |
| CVE-2023-22936 | Splunk 代码问题漏洞 — Splunk Enterprise | 6.3 | Medium | 2023-02-14 |
| CVE-2023-25162 | Nextcloud 代码问题漏洞 — security-advisories | 5.3 | Medium | 2023-02-13 |
| CVE-2023-25557 | DataHub 代码问题漏洞 — datahub | 7.5 | High | 2023-02-10 |
| CVE-2023-0574 | Yugabyte YugabyteDB Managed 安全漏洞 — YugabyteDB Anywhere | 6.8 | Medium | 2023-02-09 |
| CVE-2022-45085 | Grup Arge Energy and Control Systems SmartPower Energy Management System 代码问题漏洞 — Smartpower Web | 6.5 | Medium | 2023-02-08 |
| CVE-2023-23943 | Nextcloud 代码问题漏洞 — security-advisories | 5.0 | Medium | 2023-02-06 |
| CVE-2023-20002 | Cisco TelePresence Collaboration Endpoint Software 代码问题漏洞 — Cisco RoomOS Software | 4.4 | Medium | 2023-01-19 |
| CVE-2023-22493 | RSSHub 代码问题漏洞 — RSSHub | 8.8 | High | 2023-01-13 |
| CVE-2023-21761 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 7.5 | High | 2023-01-10 |
| CVE-2022-39039 | aEnrich a+HRD 代码问题漏洞 — a+HRD | 9.8 | Critical | 2023-01-03 |
| CVE-2017-20157 | Ariadne Component Library 代码问题漏洞 — Component Library | 5.5 | Medium | 2022-12-31 |
| CVE-2022-38203 | Esri Portal For ArcGIS 代码问题漏洞 — Portal for ArcGIS | 7.5 | High | 2022-12-30 |
| CVE-2022-38211 | Esri Portal For ArcGIS 代码问题漏洞 — ArcGIS Enterprise | 7.5 | High | 2022-12-30 |
| CVE-2022-38212 | Esri Portal For ArcGIS 代码问题漏洞 — ArcGIS Enterprise | 7.5 | High | 2022-12-30 |
| CVE-2022-23544 | MeterSphere 代码问题漏洞 — metersphere | 7.2 | High | 2022-12-27 |
| CVE-2022-4725 | AWS SDK for Android 代码问题漏洞 — AWS SDK | 5.5 | Medium | 2022-12-24 |
| CVE-2022-3189 | Dataprobe iBoot-PDU 代码问题漏洞 — iBoot-PDU FW | 5.3 | Medium | 2022-12-21 |
| CVE-2022-38708 | IBM Cognos Analytics 代码问题漏洞 — Cognos Analytics | 6.5 | Medium | 2022-12-19 |
| CVE-2022-42343 | Adobe Experience Manager 代码问题漏洞 — Adobe Campaign Classic (ACC) | 6.5 | Medium | 2022-12-19 |
| CVE-2022-46364 | Apache CXF 代码问题漏洞 — Apache CXF | 9.1 | - | 2022-12-13 |
| CVE-2022-41949 | DHIS 2 代码问题漏洞 — dhis2-core | 5.0 | Medium | 2022-12-08 |
| CVE-2022-46830 | JetBrains TeamCity 代码问题漏洞 — TeamCity | 4.1 | Medium | 2022-12-08 |
| CVE-2022-45152 | Moodle 代码问题漏洞 — Moodle | 9.1 | - | 2022-11-25 |
| CVE-2022-4096 | Appsmith 代码问题漏洞 — appsmithorg/appsmith | 6.5 | - | 2022-11-21 |
| CVE-2022-41609 | WordPress plugin Better Messages 代码问题漏洞 — Better Messages (WordPress plugin) | 6.4 | Medium | 2022-11-18 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 1696 条 CVE 漏洞。