CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-45152 | Moodle 代码问题漏洞 — Moodle | 9.1 | - | 2022-11-25 |
| CVE-2022-4096 | Appsmith 代码问题漏洞 — appsmithorg/appsmith | 6.5 | - | 2022-11-21 |
| CVE-2022-41609 | WordPress plugin Better Messages 代码问题漏洞 — Better Messages (WordPress plugin) | 6.4 | Medium | 2022-11-18 |
| CVE-2022-42894 | Siemens syngo Dynamics 代码问题漏洞 — syngo Dynamics | 7.5 | - | 2022-11-17 |
| CVE-2022-39383 | KubeVela 代码问题漏洞 — kubevela | 4.9 | Medium | 2022-11-16 |
| CVE-2022-41906 | OpenSearch Project 代码问题漏洞 — notifications | 8.7 | - | 2022-11-11 |
| CVE-2022-42494 | WordPress plugin All in One SEO Pro 代码问题漏洞 — All in One SEO Pro (WordPress plugin) | 3.0 | Low | 2022-11-08 |
| CVE-2022-20951 | Cisco BroadWorks CommPilot 代码问题漏洞 — Cisco BroadWorks | 7.7 | High | 2022-11-03 |
| CVE-2022-39276 | GLPI 代码问题漏洞 — glpi | 3.5 | Low | 2022-11-03 |
| CVE-2022-39241 | Discourse 代码问题漏洞 — discourse | 7.6 | High | 2022-11-02 |
| CVE-2022-41552 | 多款Hitachi产品代码问题漏洞 — Hitachi Infrastructure Analytics Advisor | 9.8 | Critical | 2022-11-01 |
| CVE-2022-40296 | PHP Point of Sale 代码问题漏洞 — PHP Point of Sale | 10.0 | - | 2022-10-31 |
| CVE-2022-3708 | WordPress plugin Web Stories 代码问题漏洞 — Web Stories | 9.6 | Critical | 2022-10-28 |
| CVE-2022-27622 | Synology DiskStation Manager 代码问题漏洞 — DiskStation Manager (DSM) | 4.1 | Medium | 2022-10-25 |
| CVE-2022-3247 | WordPress plugin Blog2Social 代码问题漏洞 — Blog2Social: Social Media Auto Post & Scheduler | 8.1 | - | 2022-10-25 |
| CVE-2022-39055 | Changing Information Technology RAVA certificate validation system 代码问题漏洞 — RAVA certificate validation system | 5.3 | Medium | 2022-10-18 |
| CVE-2022-2352 | WordPress plugin Post SMTP Mailer/Email Log 代码问题漏洞 — Post SMTP Mailer/Email Log | 7.2 | - | 2022-09-26 |
| CVE-2022-23464 | Nepxion 代码问题漏洞 — Discovery | 4.3 | Medium | 2022-09-24 |
| CVE-2022-38398 | Apache XML Graphics Batik 代码问题漏洞 — Apache XML Graphics | 7.5 | - | 2022-09-22 |
| CVE-2022-38648 | Apache XML Graphics Batik 代码问题漏洞 — Apache XML Graphics | 5.3 | - | 2022-09-22 |
| CVE-2022-40146 | Apache XML Graphics Batik代码问题漏洞 — Apache XML Graphics | 7.5 | - | 2022-09-22 |
| CVE-2022-39211 | Nextcloud 代码问题漏洞 — security-advisories | 3.0 | Low | 2022-09-16 |
| CVE-2022-2912 | WordPress plugin Craw Data 代码问题漏洞 — Craw Data | 5.3 | - | 2022-09-16 |
| CVE-2022-36112 | GLPI 代码问题漏洞 — glpi | 3.5 | Low | 2022-09-14 |
| CVE-2022-2900 | parse-url 代码问题漏洞 — ionicabizau/parse-url | 9.1 | - | 2022-09-14 |
| CVE-2022-36376 | WordPress plugin Rank Math 代码问题漏洞 — Rank Math SEO (WordPress plugin) | 6.8 | Medium | 2022-09-09 |
| CVE-2022-31196 | Databasir 代码问题漏洞 — databasir | 7.6 | High | 2022-09-02 |
| CVE-2022-2556 | WordPress plugin Mailchimp for WooCommerce 代码问题漏洞 — Mailchimp for WooCommerce | 2.7 | - | 2022-08-29 |
| CVE-2022-2267 | WordPress plugin Mailchimp for WooCommerce 代码问题漏洞 — Mailchimp for WooCommerce | 4.3 | - | 2022-08-29 |
| CVE-2022-38187 | Esri Portal For ArcGis 安全漏洞 — Portal for ArcGIS | 7.5 | High | 2022-08-15 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。