目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-601 指向未可信站点的URL重定向(开放重定向) 类漏洞列表 722

CWE-601 指向未可信站点的URL重定向(开放重定向) 类弱点 722 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-601 属于开放重定向漏洞，指应用程序接受用户控制的输入并用于外部链接重定向。攻击者通常利用此缺陷构造恶意 URL，诱导用户点击以跳转至钓鱼或恶意网站，从而窃取凭证或传播恶意软件。开发者应避免直接使用用户输入作为重定向目标，需对目标域名进行白名单校验，或使用经过编码的内部标识符替代直接链接，确保重定向逻辑的安全可控。

MITRE CWE 官方描述
CWE：CWE-601 URL Redirection to Untrusted Site ('Open Redirect') 英文：Web 应用程序接受由用户控制的输入，该输入指定指向外部站点的链接，并在重定向中使用该链接。
常见影响 (2)
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity
The user may be redirected to an untrusted page that contains malware which may then compromise the user's system. In some cases, an open redirect can also enable the immediate download of a file without the user's permission, because the r…
Access Control, Confidentiality, OtherBypass Protection Mechanism, Gain Privileges or Assume Identity, Other
By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam. The user may be subjected to phishing attacks by being redirected to an untrusted page. The phishing attack may point to an attacker controlled web page that appears to be a trusted web site. The phi…
缓解措施 (5)
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and DesignUse an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Architecture and DesignWhen the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Architecture and DesignEnsure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Architecture and Design, ImplementationUnderstand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly throug…
代码示例 (2)
The following code obtains a URL from the query string and then redirects the user to that URL.
$redirect_url = $_GET['url']; header("Location: " . $redirect_url);
Bad · PHP
http://example.com/example.php?url=http://malicious.example.com
Attack
The following code is a Java servlet that will receive a GET request with a url parameter in the request to redirect the browser to the address specified in the url parameter. The servlet will retrieve the url parameter value from the request and send a response to redirect the browser to the url address.
public class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }
Bad · Java
<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>
Attack · HTML
CVE ID标题CVSS风险等级Published
CVE-2026-42350 Kargo OIDC登录重定向漏洞 — kargo--2026-05-08
CVE-2026-42195 GitLab URL参数未验证导致OAuth授权重定向漏洞 — drawio 3.4 Low2026-05-08
CVE-2026-3318 Cadle电子商务系统多个漏洞 — e-commerce--2026-05-08
CVE-2026-42259 Saltcorn POST /auth/login 开放重定向漏洞 — saltcorn--2026-05-07
CVE-2026-6795 DivvyDrive 开放重定向漏洞 — DivvyDrive 9.6 Critical2026-05-07
CVE-2026-40332 Masa CMS 方案相对URL处理不当导致开放重定向漏洞 — MasaCMS--2026-05-06
CVE-2026-43576 OpenClaw <2026.4.5 通过CDP WebSocket的二次跳转SSRF漏洞 — OpenClaw 7.7 High2026-05-06
CVE-2025-61669 jupyter_server next参数开放重定向漏洞 — jupyter_server--2026-05-05
CVE-2026-42230 n8n MCP OAuth流程中开放重定向漏洞 — n8n 6.1AIMediumAI2026-05-04
CVE-2026-41226 Ricoh Web Image Monitor开放重定向漏洞 — Multiple laser printers and MFPs which implement Web Image Monitor 6.1AIMediumAI2026-04-30
CVE-2026-33102 Microsoft M365 Copilot 输入验证错误漏洞 — Microsoft 365 Copilot 9.3 Critical2026-04-23
CVE-2026-41126 BigBlueButton 输入验证错误漏洞 — bigbluebutton 4.3 Medium2026-04-21
CVE-2026-40905 LinkAce 输入验证错误漏洞 — LinkAce 8.1 High2026-04-21
CVE-2026-40299 next-intl 安全漏洞 — next-intl 6.1AIMediumAI2026-04-17
CVE-2026-40255 @adonisjs/http-server 安全漏洞 — http-server 6.1 Medium2026-04-16
CVE-2026-20060 Cisco Unity Connection 安全漏洞 — Cisco Unity Connection 4.7 Medium2026-04-15
CVE-2026-21741 Fortinet FortiNAC-F 输入验证错误漏洞 — FortiNAC-F 2.2 Low2026-04-14
CVE-2026-34257 SAP NetWeaver Application Server ABAP 输入验证错误漏洞 — SAP NetWeaver Application Server ABAP 6.1 Medium2026-04-14
CVE-2026-6203 WordPress plugin User Registration & Membership 输入验证错误漏洞 — User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 6.1 Medium2026-04-13
CVE-2026-39940 ChurchCRM 输入验证错误漏洞 — CRM 5.4 -2026-04-13
CVE-2026-32932 Chamilo LMS 输入验证错误漏洞 — chamilo-lms 4.7 Medium2026-04-10
CVE-2025-66447 Chamilo LMS 输入验证错误漏洞 — chamilo-lms--2026-04-10
CVE-2026-22560 Rocket.Chat 安全漏洞 — Rocket.Chat 6.1 -2026-04-10
CVE-2026-25854 Apache Tomcat 输入验证错误漏洞 — Apache Tomcat 6.1AIMediumAI2026-04-09
CVE-2026-39985 LORIS Neuroimaging Platform 输入验证错误漏洞 — Loris 4.3 Medium2026-04-09
CVE-2026-40037 OpenClaw 输入验证错误漏洞 — OpenClaw 6.5 Medium2026-04-08
CVE-2026-39484 WordPress plugin Hide My WP Ghost 输入验证错误漏洞 — Hide My WP Ghost 4.7 Medium2026-04-08
CVE-2026-35411 Directus 输入验证错误漏洞 — directus 4.3 Medium2026-04-06
CVE-2026-35404 Open edX Platform 输入验证错误漏洞 — openedx-platform 4.7 Medium2026-04-06
CVE-2026-35475 WeGIA 输入验证错误漏洞 — WeGIA 6.1AIMediumAI2026-04-06

CWE-601（指向未可信站点的URL重定向(开放重定向)） 是常见的弱点类别，本平台收录该类弱点关联的 722 条 CVE 漏洞。