CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-26435 | Open-Xchange App Suite 代码问题漏洞 — OX App Suite | 5.0 | Medium | 2023-06-20 |
| CVE-2023-26431 | Open-Xchange OX App Suite 代码问题漏洞 — OX App Suite | 5.0 | Medium | 2023-06-20 |
| CVE-2023-29292 | Adobe Commerce 代码问题漏洞 — Magento Commerce | 4.9 | Medium | 2023-06-15 |
| CVE-2023-29291 | Adobe Commerce 代码问题漏洞 — Magento Commerce | 4.9 | Medium | 2023-06-15 |
| CVE-2023-3238 | OTCMS 代码问题漏洞 — OTCMS | 6.3 | Medium | 2023-06-14 |
| CVE-2023-3236 | mccms 代码问题漏洞 — mccms | 6.3 | Medium | 2023-06-14 |
| CVE-2023-3235 | mccms 代码问题漏洞 — mccms | 6.3 | Medium | 2023-06-14 |
| CVE-2023-3233 | Zhongbang CRMEB 代码问题漏洞 — CRMEB | 6.3 | Medium | 2023-06-14 |
| CVE-2023-25609 | Fortinet FortiManager 代码问题漏洞 — FortiAnalyzer | 4.2 | Medium | 2023-06-13 |
| CVE-2023-3188 | Owncast 代码问题漏洞 — owncast/owncast | 7.5 | - | 2023-06-10 |
| CVE-2023-1895 | WordPress Plugin Gutenberg Blocks 代码问题漏洞 — Getwid – Gutenberg Blocks | 8.5 | High | 2023-06-09 |
| CVE-2023-3121 | Dahua Smart Parking Management 代码问题漏洞 — Smart Parking Management | 3.5 | Low | 2023-06-06 |
| CVE-2023-3015 | Vip Video Analysis 代码问题漏洞 — Vip Video Analysis | 6.3 | Medium | 2023-05-31 |
| CVE-2023-2927 | JIZHICMS 代码问题漏洞 — JIZHICMS | 6.3 | Medium | 2023-05-27 |
| CVE-2023-33184 | Nextcloud 代码问题漏洞 — security-advisories | 3.5 | Low | 2023-05-27 |
| CVE-2023-32348 | Teltonika Remote Management System 代码问题漏洞 — Remote Management System | 5.8 | Medium | 2023-05-22 |
| CVE-2022-29840 | Western Digital My Cloud OS 代码问题漏洞 — My Cloud OS 5 | 5.1 | Medium | 2023-05-10 |
| CVE-2023-24954 | Microsoft SharePoint 安全漏洞 — Microsoft SharePoint Enterprise Server 2016 | 6.5 | Medium | 2023-05-09 |
| CVE-2023-30444 | IBM Cloud Pak for Data 代码问题漏洞 — Watson Machine Learning on Cloud Pak for Data | 7.1 | High | 2023-04-27 |
| CVE-2022-48477 | JetBrains Hub 代码问题漏洞 — Hub | 4.1 | Medium | 2023-04-24 |
| CVE-2023-2140 | Dassault Systèmes DELMIA Apriso 代码问题漏洞 — DELMIA Apriso | 7.5 | High | 2023-04-21 |
| CVE-2023-25504 | Apache Superset 代码问题漏洞 — Apache Superset | 4.9 | Medium | 2023-04-17 |
| CVE-2023-28288 | Microsoft SharePoint 安全漏洞 — Microsoft SharePoint Enterprise Server 2016 | 8.1 | High | 2023-04-11 |
| CVE-2023-1971 | tpAdmin 代码问题漏洞 — tpAdmin | 6.3 | Medium | 2023-04-10 |
| CVE-2023-29008 | svelte 跨站请求伪造漏洞 — kit | 8.8 | High | 2023-04-06 |
| CVE-2023-29010 | Budibase 代码问题漏洞 — budibase | 6.5 | Medium | 2023-04-06 |
| CVE-2023-28633 | GLPI 代码问题漏洞 — glpi | 3.5 | Low | 2023-04-05 |
| CVE-2023-1725 | Infoline Project Management System 代码问题漏洞 — Project Management System | 9.8 | Critical | 2023-03-30 |
| CVE-2023-25195 | Apache Fineract 代码问题漏洞 — Apache Fineract | 8.1 | - | 2023-03-28 |
| CVE-2023-1634 | OTCMS 代码问题漏洞 — OTCMS | 6.3 | Medium | 2023-03-25 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。