CWE-601 指向未可信站点的URL重定向(开放重定向) 类弱点 722 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-601 属于开放重定向漏洞，指应用程序接受用户控制的输入并用于外部链接重定向。攻击者通常利用此缺陷构造恶意 URL，诱导用户点击以跳转至钓鱼或恶意网站，从而窃取凭证或传播恶意软件。开发者应避免直接使用用户输入作为重定向目标，需对目标域名进行白名单校验，或使用经过编码的内部标识符替代直接链接，确保重定向逻辑的安全可控。
$redirect_url = $_GET['url']; header("Location: " . $redirect_url);http://example.com/example.php?url=http://malicious.example.compublic class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-0645 | posthog 输入验证错误漏洞 — posthog/posthog | 6.1 | - | 2022-04-19 |
| CVE-2020-25154 | B. Braun Melsungen Ag B. Braun Melsungen AG SpaceCom 输入验证错误漏洞 — SpaceCom | 5.4 | Medium | 2022-04-14 |
| CVE-2022-28215 | SAP NetWeaver ABAP Server 输入验证错误漏洞 — SAP NetWeaver ABAP Server and ABAP Platform | 4.7 | - | 2022-04-12 |
| CVE-2022-24794 | Auth0 Express OpenId Connect 输入验证错误漏洞 — express-openid-connect | 7.5 | High | 2022-03-31 |
| CVE-2005-10001 | Broadcom Netegrity SiteMinder 输入验证错误漏洞 — SiteMinder | 5.4 | Medium | 2022-03-28 |
| CVE-2022-24776 | Flask-AppBuilder 输入验证错误漏洞 — Flask-AppBuilder | 6.1 | Medium | 2022-03-24 |
| CVE-2022-1058 | Gitea 输入验证错误漏洞 — go-gitea/gitea | 6.1 | - | 2022-03-24 |
| CVE-2022-0165 | WordPress plugin 输入验证错误漏洞 — Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme | 6.1 | - | 2022-03-14 |
| CVE-2022-24739 | AllTube Download 代码问题漏洞 — alltube | 7.3 | High | 2022-03-08 |
| CVE-2021-41180 | Nextcloud Talk 输入验证错误漏洞 — security-advisories | 4.7 | Medium | 2022-03-08 |
| CVE-2022-0697 | archivy 输入验证错误漏洞 — archivy/archivy | 6.1 | - | 2022-03-06 |
| CVE-2022-0868 | Medialize URI.js 输入验证错误漏洞 — medialize/uri.js | 6.1 | - | 2022-03-06 |
| CVE-2022-0869 | Github spirit 输入验证错误漏洞 — nitely/spirit | 6.1 | - | 2022-03-06 |
| CVE-2021-3654 | OpenStack 输入验证错误漏洞 — openstack-nova | 6.1 | - | 2022-03-02 |
| CVE-2022-0692 | AllTube Download 输入验证错误漏洞 — rudloff/alltube | 6.1 | - | 2022-02-21 |
| CVE-2022-0597 | Packagist microweber 输入验证错误漏洞 — microweber/microweber | 6.1 | - | 2022-02-15 |
| CVE-2021-25033 | WordPress 输入验证错误漏洞 — WordPress Newsletter Plugin – Noptin | 6.1 | - | 2022-02-14 |
| CVE-2022-0560 | Microweber 输入验证错误漏洞 — microweber/microweber | 6.1 | - | 2022-02-11 |
| CVE-2022-23618 | Xwiki Platform 输入验证错误漏洞 — xwiki-platform | 4.7 | Medium | 2022-02-09 |
| CVE-2022-23102 | Siemens SINEMA Remote Connect Server 输入验证错误漏洞 — SINEMA Remote Connect Server | 6.1 | - | 2022-02-09 |
| CVE-2021-25074 | WordPress plugin 输入验证错误漏洞 — WebP Converter for Media – Convert WebP and AVIF & Optimize Images | 6.1 | - | 2022-01-24 |
| CVE-2021-25028 | WordPress plugin 输入验证错误漏洞 — Event Tickets | 6.1 | - | 2022-01-24 |
| CVE-2021-24838 | WordPress plugin AnyComment 输入验证错误漏洞 — AnyComment | 6.1 | - | 2022-01-17 |
| CVE-2021-38678 | Qnap QcalAgent 输入验证错误漏洞 — QcalAgent | 6.1 | Medium | 2022-01-14 |
| CVE-2021-44528 | Rails Action Pack 输入验证错误漏洞 — https://github.com/rails/rails | 6.1 | - | 2022-01-07 |
| CVE-2022-0122 | Digital Bazaar Forge 输入验证错误漏洞 — digitalbazaar/forge | 6.1 | - | 2022-01-06 |
| CVE-2022-21651 | Shopware 输入验证错误漏洞 — shopware | 6.8 | Medium | 2022-01-05 |
| CVE-2021-40852 | Tcman Gim 输入验证错误漏洞 — GIM | 6.1 | Medium | 2021-12-17 |
| CVE-2021-43812 | Auth0 输入验证错误漏洞 — nextjs-auth0 | 6.4 | Medium | 2021-12-16 |
| CVE-2021-3829 | Wordpress Easy Redirect Manager输入验证错误漏洞 — openwhyd/openwhyd | 6.1 | - | 2021-12-10 |
CWE-601（指向未可信站点的URL重定向(开放重定向)） 是常见的弱点类别，本平台收录该类弱点关联的 722 条 CVE 漏洞。