目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1325 元

100%
请我们喝杯咖啡

CWE-601 指向未可信站点的URL重定向(开放重定向) 类漏洞列表 776

CWE-601 指向未可信站点的URL重定向(开放重定向) 类弱点 776 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-601 属于开放重定向漏洞，指应用程序接受用户控制的输入并用于外部链接重定向。攻击者通常利用此缺陷构造恶意 URL，诱导用户点击以跳转至钓鱼或恶意网站，从而窃取凭证或传播恶意软件。开发者应避免直接使用用户输入作为重定向目标，需对目标域名进行白名单校验，或使用经过编码的内部标识符替代直接链接，确保重定向逻辑的安全可控。

MITRE CWE 官方描述
CWE：CWE-601 URL Redirection to Untrusted Site ('Open Redirect') 英文：Web 应用程序接受由用户控制的输入，该输入指定指向外部站点的链接，并在重定向中使用该链接。
常见影响 (2)
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity
The user may be redirected to an untrusted page that contains malware which may then compromise the user's system. In some cases, an open redirect can also enable the immediate download of a file without the user's permission, because the r…
Access Control, Confidentiality, OtherBypass Protection Mechanism, Gain Privileges or Assume Identity, Other
By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam. The user may be subjected to phishing attacks by being redirected to an untrusted page. The phishing attack may point to an attacker controlled web page that appears to be a trusted web site. The phi…
缓解措施 (5)
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and DesignUse an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Architecture and DesignWhen the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Architecture and DesignEnsure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Architecture and Design, ImplementationUnderstand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly throug…
代码示例 (2)
The following code obtains a URL from the query string and then redirects the user to that URL.
$redirect_url = $_GET['url']; header("Location: " . $redirect_url);
Bad · PHP
http://example.com/example.php?url=http://malicious.example.com
Attack
The following code is a Java servlet that will receive a GET request with a url parameter in the request to redirect the browser to the address specified in the url parameter. The servlet will retrieve the url parameter value from the request and send a response to redirect the browser to the url address.
public class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }
Bad · Java
<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>
Attack · HTML
CVE ID标题CVSS风险等级Published
CVE-2026-49380 JetBrains TeamCity 输入验证错误漏洞 — TeamCity 3.1 Low2026-05-29
CVE-2026-45307 Speakr 安全漏洞 — speakr 6.1 Medium2026-05-28
CVE-2026-44681 Authlib 安全漏洞 — authlib 6.1 Medium2026-05-27
CVE-2026-45335 WeGIA 输入验证错误漏洞 — WeGIA 5.4 Medium2026-05-27
CVE-2026-49059 WordPress plugin Facebook for WooCommerce 输入验证错误漏洞 — Facebook for WooCommerce 4.7 Medium2026-05-27
CVE-2026-44833 Snipe-IT 输入验证错误漏洞 — snipe-it 5.9 Medium2026-05-26
CVE-2026-48589 Apache Shiro 安全漏洞 — Apache Shiro--2026-05-25
CVE-2026-44598 Apache Shiro 安全漏洞 — Apache Shiro Jakarta EE module--2026-05-25
CVE-2026-47070 Hackney 安全漏洞 — hackney--2026-05-25
CVE-2026-48832 SPIP 输入验证错误漏洞 — SPIP 3.5 Low2026-05-24
CVE-2026-40295 Devise 输入验证错误漏洞 — devise 6.1 Medium2026-05-22
CVE-2026-9245 Devolutions Server 安全漏洞 — Server--2026-05-22
CVE-2025-26483 Dell PowerFlex Manager 输入验证错误漏洞 — PowerFlex Manager (Appliance) 6.1 Medium2026-05-22
CVE-2026-7504 Keycloak 输入验证错误漏洞 — Red Hat build of Keycloak 26.2 8.1 High2026-05-19
CVE-2025-65954 SimpleSAMLphp-casserver 输入验证错误漏洞 — simplesamlphp-module-casserver--2026-05-18
CVE-2026-42207 magento-lts 输入验证错误漏洞 — magento-lts 6.1 Medium2026-05-15
CVE-2026-44427 MCP Registry 输入验证错误漏洞 — registry--2026-05-14
CVE-2026-44520 Docling Graph 输入验证错误漏洞 — docling-graph 5.7 Medium2026-05-14
CVE-2026-45448 ntopng 输入验证错误漏洞 — ntopng 4.3 Medium2026-05-14
CVE-2026-44503 Kiota Java Libraries 输入验证错误漏洞 — kiota-java--2026-05-14
CVE-2026-44372 Nitro 输入验证错误漏洞 — nitro--2026-05-13
CVE-2026-41513 Horilla 输入验证错误漏洞 — horilla-hr--2026-05-12
CVE-2026-42565 @workos/authkit-session 输入验证错误漏洞 — authkit-session 4.3 Medium2026-05-11
CVE-2026-42350 kargo 输入验证错误漏洞 — kargo 6.1AIMediumAI2026-05-08
CVE-2026-42195 draw.io 信息泄露漏洞 — drawio 3.4 Low2026-05-08
CVE-2026-3318 Cradle eCommerce 输入验证错误漏洞 — e-commerce 6.1AIMediumAI2026-05-08
CVE-2026-42259 Saltcorn 输入验证错误漏洞 — saltcorn 5.4AIMediumAI2026-05-07
CVE-2026-6795 DivvyDrive 输入验证错误漏洞 — DivvyDrive 9.6 Critical2026-05-07
CVE-2026-40332 Masa CMS 输入验证错误漏洞 — MasaCMS 6.1AIMediumAI2026-05-06
CVE-2026-43576 OpenClaw 输入验证错误漏洞 — OpenClaw 7.7 High2026-05-06

CWE-601（指向未可信站点的URL重定向(开放重定向)） 是常见的弱点类别，本平台收录该类弱点关联的 776 条 CVE 漏洞。