CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-50266 | Bazarr 代码问题漏洞 — bazarr | 5.3 | Medium | 2023-12-15 |
| CVE-2023-49159 | WordPress Plugin CommentLuv 代码问题漏洞 — CommentLuv | 7.2 | High | 2023-12-15 |
| CVE-2023-48379 | Softnext Technologies Mail SQR Expert 代码问题漏洞 — Mail SQR Expert | 5.3 | Medium | 2023-12-15 |
| CVE-2023-6570 | Kubeflow 代码问题漏洞 — kubeflow/kubeflow | 9.1AI | Critical AI | 2023-12-14 |
| CVE-2023-40630 | Joomla 安全漏洞 — JCDashboards component for Joomla | 9.1AI | Critical AI | 2023-12-14 |
| CVE-2023-47619 | Audiobookshelf 代码问题漏洞 — audiobookshelf | 8.1 | High | 2023-12-13 |
| CVE-2023-49795 | MindsDB 代码问题漏洞 — mindsdb | 6.5 | Medium | 2023-12-11 |
| CVE-2023-49799 | nuxt-api-party 代码问题漏洞 — nuxt-api-party | 7.5 | High | 2023-12-08 |
| CVE-2022-45362 | WordPress Plugin Paytm Payment Gateway 代码问题漏洞 — Paytm Payment Gateway | 7.2 | High | 2023-12-07 |
| CVE-2023-41804 | WordPress Plugin Starter Templates 代码问题漏洞 — Starter Templates — Elementor, WordPress & Beaver Builder Templates | 7.1 | High | 2023-12-07 |
| CVE-2023-46641 | WordPress Plugin 12 Step Meeting List 代码问题漏洞 — 12 Step Meeting List | 4.9 | Medium | 2023-12-07 |
| CVE-2023-49746 | WordPress Plugin SpeedyCache 代码问题漏洞 — SpeedyCache – Cache, Optimization, Performance | 4.9 | Medium | 2023-12-07 |
| CVE-2023-46736 | EspoCRM 代码问题漏洞 — espocrm | 5.3 | Medium | 2023-12-05 |
| CVE-2023-46746 | PostHog 代码问题漏洞 — posthog | 4.8 | Medium | 2023-12-01 |
| CVE-2023-49094 | Symbolicator 代码问题漏洞 — symbolicator | 4.3 | Medium | 2023-11-30 |
| CVE-2023-6070 | Trellix Enterprise Security Manager 代码问题漏洞 — Trellix Enterprise Security Manager (ESM) | 4.3 | Medium | 2023-11-29 |
| CVE-2023-48711 | google-translate-api-browser 代码问题漏洞 — google-translate-api-browser | 3.7 | Low | 2023-11-24 |
| CVE-2023-27451 | WordPress Plugin Instant Images 安全漏洞 — Instant Images | 7.2 | High | 2023-11-22 |
| CVE-2023-48307 | Nextcloud 代码问题漏洞 — security-advisories | 3.5 | Low | 2023-11-21 |
| CVE-2023-48306 | Nextcloud 代码问题漏洞 — security-advisories | 5.0 | Medium | 2023-11-21 |
| CVE-2023-6199 | BookStack 代码问题漏洞 — BookStack | 6.5 | Medium | 2023-11-20 |
| CVE-2023-6124 | SuiteCRM 安全漏洞 — salesagility/suitecrm | 6.5 | - | 2023-11-14 |
| CVE-2022-45835 | WordPress Plugin PhonePe Payment Solutions 代码问题漏洞 — PhonePe Payment Solutions | 5.8 | Medium | 2023-11-13 |
| CVE-2023-23684 | WordPress Plugin WPGraphQL 代码问题漏洞 — WPGraphQL | 4.4 | Medium | 2023-11-13 |
| CVE-2023-23800 | WordPress Plugin WP Shortcodes Plugin — Shortcodes Ultimate 代码问题漏洞 — WP Shortcodes Plugin — Shortcodes Ultimate | 7.1 | High | 2023-11-13 |
| CVE-2023-46207 | WordPress Plugin Motors – Car Dealer, Classifieds & Listing 代码问题漏洞 — Motors – Car Dealer, Classifieds & Listing | 4.1 | Medium | 2023-11-13 |
| CVE-2023-41239 | WordPress Plugin PowerPress Podcasting plugin by Blubrry 代码问题漏洞 — PowerPress Podcasting plugin by Blubrry | 6.4 | Medium | 2023-11-13 |
| CVE-2023-37978 | WordPress Plugin HTTP Headers 代码问题漏洞 — HTTP Headers | 4.4 | Medium | 2023-11-13 |
| CVE-2023-38515 | WordPress Plugin Church Admin 代码问题漏洞 — Church Admin | 5.5 | Medium | 2023-11-13 |
| CVE-2023-34013 | WordPress Plugin Poll Maker – Best WordPress Poll Plugin 代码问题漏洞 — Poll Maker – Best WordPress Poll Plugin | 4.4 | Medium | 2023-11-13 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。