CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-31219 | WordPress Plugin Download Monitor 代码问题漏洞 — Download Monitor | 4.1 | Medium | 2023-11-13 |
| CVE-2023-47121 | Discourse 安全漏洞 — discourse | 3.4 | Low | 2023-11-10 |
| CVE-2023-46729 | Mobileiron Sentry 安全漏洞 — sentry-javascript | 9.3 | Critical | 2023-11-10 |
| CVE-2023-46730 | Group Office CRM 代码问题漏洞 — groupoffice | 7.4 | High | 2023-11-07 |
| CVE-2022-3172 | Kubernetes 代码问题漏洞 — kube-apiserver | 5.1 | Medium | 2023-11-03 |
| CVE-2023-39301 | QNAP Systems QTS和QuTS hero 代码问题漏洞 — QTS | 4.3 | Medium | 2023-11-03 |
| CVE-2023-4769 | ZOHO ManageEngine Desktop Central 代码问题漏洞 — Desktop Central | 6.6 | Medium | 2023-11-03 |
| CVE-2023-35896 | IBM Content Navigator 安全漏洞 — Content Navigator | 5.4 | Medium | 2023-11-03 |
| CVE-2023-46725 | foodcoopshop 代码问题漏洞 — foodcoopshop | 8.1 | High | 2023-11-02 |
| CVE-2023-46236 | FOGProject 代码问题漏洞 — fogproject | 8.6 | High | 2023-10-31 |
| CVE-2023-43798 | BigBlueButton 代码问题漏洞 — bigbluebutton | 5.6 | Medium | 2023-10-30 |
| CVE-2023-46124 | Fides 代码问题漏洞 — fides | 8.2 | High | 2023-10-24 |
| CVE-2023-43795 | GeoServer 代码问题漏洞 — geoserver | 8.6 | High | 2023-10-24 |
| CVE-2023-41339 | GeoServer 代码问题漏洞 — geoserver | 8.6 | High | 2023-10-24 |
| CVE-2023-41899 | Home Assistant 代码问题漏洞 — core | 6.6 | Medium | 2023-10-19 |
| CVE-2023-45822 | Artifact Hub 代码问题漏洞 — hub | 3.7 | Low | 2023-10-19 |
| CVE-2023-25753 | Apache ShenYu 代码问题漏洞 — Apache ShenYu | 9.1 | - | 2023-10-19 |
| CVE-2023-45152 | Engelsystem 代码问题漏洞 — engelsystem | 2.0 | Low | 2023-10-16 |
| CVE-2023-45660 | Nextcloud 代码问题漏洞 — security-advisories | 4.3 | Medium | 2023-10-16 |
| CVE-2023-5572 | vrite 代码问题漏洞 — vriteio/vrite | 7.5 | - | 2023-10-13 |
| CVE-2023-26366 | Adobe Commerce 代码问题漏洞 — Adobe Commerce | 6.8 | Medium | 2023-10-13 |
| CVE-2023-41763 | Microsoft Skype for Business 安全漏洞 — Skype for Business Server 2015 CU13 | 5.3 | Medium | 2023-10-10 |
| CVE-2023-42477 | SAP NetWeaver AS 代码问题漏洞 — SAP NetWeaver AS Java | 6.5 | Medium | 2023-10-10 |
| CVE-2023-3744 | SLims 代码问题漏洞 — SLiMS | 9.9 | Critical | 2023-10-02 |
| CVE-2023-43654 | PyTorch 代码问题漏洞 — serve | 10.0 | Critical | 2023-09-28 |
| CVE-2023-42812 | Galaxy 代码问题漏洞 — galaxy | 6.3 | Medium | 2023-09-22 |
| CVE-2023-42450 | Mastodon 代码问题漏洞 — mastodon | 5.4 | Medium | 2023-09-19 |
| CVE-2023-3025 | WordPress Plugin Dropbox Folder Share 代码问题漏洞 — Dropbox Folder Share | 7.2 | High | 2023-09-16 |
| CVE-2023-42439 | GeoNode 代码问题漏洞 — geonode | 7.5 | High | 2023-09-15 |
| CVE-2023-4893 | WordPress plugin Crayon Syntax Highlighter 代码问题漏洞 — Crayon Syntax Highlighter | 6.4 | Medium | 2023-09-12 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。