CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-4878 | iCMS 代码问题漏洞 — instantsoft/icms2 | 7.5 | - | 2023-09-10 |
| CVE-2023-39967 | WireMock 代码问题漏洞 — wiremock | 10.0 | Critical | 2023-09-06 |
| CVE-2023-41327 | WireMock 代码问题漏洞 — wiremock | 4.6 | Medium | 2023-09-06 |
| CVE-2023-36388 | Apache Superset 代码问题漏洞 — Apache Superset | 4.3 | Medium | 2023-09-06 |
| CVE-2023-41055 | LibreY 代码问题漏洞 — LibreY | 7.5 | High | 2023-09-04 |
| CVE-2023-41054 | LibreY 代码问题漏洞 — LibreY | 8.2 | High | 2023-09-04 |
| CVE-2023-4651 | iCMS2 代码问题漏洞 — instantsoft/icms2 | 7.5 | - | 2023-08-31 |
| CVE-2023-4624 | BookStack 代码问题漏洞 — bookstackapp/bookstack | 7.5 | - | 2023-08-30 |
| CVE-2023-40017 | GeoNode 代码问题漏洞 — geonode | 7.5 | High | 2023-08-24 |
| CVE-2022-44729 | Apache XML Graphics Batik 代码问题漏洞 — Apache XML Graphics Batik | 8.2 | - | 2023-08-22 |
| CVE-2022-44730 | Apache XML Graphics Batik 代码问题漏洞 — Apache XML Graphics Batik | 6.5 | - | 2023-08-22 |
| CVE-2023-24515 | Artica Pandora FMS 代码问题漏洞 — Pandora FMS | 5.2 | Medium | 2023-08-22 |
| CVE-2023-35011 | IBM Cognos Analytics 代码问题漏洞 — Cognos Analytics | 5.4 | Medium | 2023-08-16 |
| CVE-2023-40033 | Flarum 代码问题漏洞 — framework | 7.1 | High | 2023-08-16 |
| CVE-2023-3958 | WordPress Plugin Remote Users Sync 代码问题漏洞 — WP Remote Users Sync | 8.5 | High | 2023-08-16 |
| CVE-2023-26442 | Open-Xchange AppSuite 代码问题漏洞 — OX App Suite | 3.2 | Low | 2023-08-02 |
| CVE-2023-26438 | Open-Xchange AppSuite 跨站脚本漏洞 — OX App Suite | 4.3 | Medium | 2023-08-02 |
| CVE-2023-3981 | Omeka S 代码问题漏洞 — omeka/omeka-s | 7.5 | - | 2023-07-27 |
| CVE-2023-37290 | InfoDoc Document On-line Submission and Approval System 代码问题漏洞 — Document On-line Submission and Approval System | 7.5 | High | 2023-07-20 |
| CVE-2023-29260 | IBM Sterling Connect:Express for UNIX 代码问题漏洞 — Sterling Connect:Express for UNIX | 6.5 | Medium | 2023-07-19 |
| CVE-2023-3577 | Mattermost 代码问题漏洞 — Mattermost | 3.5 | Low | 2023-07-17 |
| CVE-2023-32052 | Microsoft Power Apps 安全漏洞 — Microsoft Power Apps | 5.4 | Medium | 2023-07-11 |
| CVE-2023-36925 | SAP Solution Manager 代码问题漏洞 — SAP Solution Manager (Diagnostics agent) | 7.2 | High | 2023-07-11 |
| CVE-2023-3578 | Desdev DedeCMS 代码问题漏洞 — DedeCMS | 5.5 | Medium | 2023-07-10 |
| CVE-2021-42079 | OSNEXUS QuantaStor 代码问题漏洞 — QuantaStor | 6.2 | Medium | 2023-07-10 |
| CVE-2023-37262 | Tweaked 代码问题漏洞 — CC-Tweaked | 9.6 | Critical | 2023-07-07 |
| CVE-2023-37261 | OpenComputers 代码问题漏洞 — OpenComputers | 9.6 | Critical | 2023-07-07 |
| CVE-2023-3432 | PlantUML 代码问题漏洞 — plantuml/plantuml | 7.5 | - | 2023-06-27 |
| CVE-2023-33176 | BigBlueButton 代码问题漏洞 — bigbluebutton | 4.8 | Medium | 2023-06-26 |
| CVE-2023-35133 | Moodle 代码问题漏洞 | 7.5 | High | 2023-06-22 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。