CWE-918 服务端请求伪造(SSRF) 类弱点 1659 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-23080 | Directus 代码问题漏洞 — directus | 5.0 | - | 2022-06-22 |
| CVE-2022-23071 | Recipes 代码问题漏洞 — recipes | 6.5 | - | 2022-06-19 |
| CVE-2022-29612 | SAP Host Agent 代码问题漏洞 — SAP NetWeaver, ABAP Platform and SAP Host Agent | - | - | 2022-06-14 |
| CVE-2022-28217 | SAP NetWeaver 代码问题漏洞 — SAP NetWeaver (EP Web Page Composer) | 6.5 | - | 2022-06-13 |
| CVE-2022-24969 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 6.1 | - | 2022-06-06 |
| CVE-2022-1285 | Gogs 代码问题漏洞 — gogs/gogs | 8.2 | - | 2022-06-01 |
| CVE-2021-40186 | DNN 代码问题漏洞 — DNN Platform | 6.5 | Medium | 2022-05-31 |
| CVE-2022-29188 | Smokescreen 代码问题漏洞 — smokescreen | 5.3 | Medium | 2022-05-20 |
| CVE-2022-1784 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-20 |
| CVE-2022-1767 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-18 |
| CVE-2022-24856 | FlyteConsole 代码问题漏洞 — flyteconsole | 9.1 | Critical | 2022-05-17 |
| CVE-2022-1711 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-17 |
| CVE-2022-1723 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-17 |
| CVE-2022-1713 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-16 |
| CVE-2022-1722 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 6.2 | - | 2022-05-16 |
| CVE-2022-1398 | WordPress plugin External Media without Import 代码问题漏洞 — External Media without Import | 6.5 | - | 2022-05-16 |
| CVE-2022-1386 | WordPress plugin Fusion Builder 代码问题漏洞 — Fusion Builder | 9.1 | - | 2022-05-16 |
| CVE-2022-1379 | PlantUML 代码问题漏洞 — plantuml/plantuml | 10.0 | - | 2022-05-14 |
| CVE-2022-29180 | Charm 代码问题漏洞 — charm | 5.9 | Medium | 2022-05-07 |
| CVE-2022-1592 | Clinical-Genomics Scout 代码问题漏洞 — clinical-genomics/scout | 8.2 | - | 2022-05-05 |
| CVE-2022-1239 | WordPress plugin HubSpot 代码问题漏洞 — HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics | 8.1 | - | 2022-05-02 |
| CVE-2021-36203 | Johnson Controls Metasys system 代码问题漏洞 — Metasys System Configuration Tool (SCT) | 5.3 | Medium | 2022-04-22 |
| CVE-2022-24871 | Shopware 代码问题漏洞 — platform | 7.2 | High | 2022-04-20 |
| CVE-2022-24862 | Databasir 代码问题漏洞 — databasir | 7.7 | High | 2022-04-20 |
| CVE-2022-24825 | Smokescreen 代码问题漏洞 — smokescreen | 5.8 | Medium | 2022-04-19 |
| CVE-2022-1037 | WordPress plugin EXMAGE 代码问题漏洞 — EXMAGE – WordPress Image Links | 8.8 | - | 2022-04-18 |
| CVE-2021-36202 | Johnson Controls Metasys system 代码问题漏洞 — Metasys | 8.4 | High | 2022-04-07 |
| CVE-2022-1213 | livehelperchat 代码问题漏洞 — livehelperchat/livehelperchat | 8.1 | - | 2022-04-05 |
| CVE-2022-0990 | Calibre-Web 代码问题漏洞 — janeczku/calibre-web | 9.4 | - | 2022-04-04 |
| CVE-2022-0939 | Calibre-Web 代码问题漏洞 — janeczku/calibre-web | 9.4 | - | 2022-04-04 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 1659 条 CVE 漏洞。