45 vulnerabilities classified as CWE-610 (资源在另一范围的外部可控制索引). AI Chinese analysis included.
CWE-610 represents a critical input validation weakness where software improperly resolves references to resources located outside its intended security boundary. This flaw typically arises when applications accept user-supplied filenames, URLs, or identifiers without rigorous sanitization, allowing attackers to redirect execution or data access to unauthorized external systems. Exploitation often leads to severe consequences such as remote code execution, data exfiltration, or unauthorized access to sensitive internal resources by manipulating the reference path. To mitigate this risk, developers must implement strict allow-listing strategies, ensuring that only predefined, safe resources are accessible. Additionally, employing canonicalization techniques to normalize input paths and verifying that resolved resources remain within the expected directory or network sphere are essential practices. By enforcing these controls, organizations can prevent attackers from bypassing security boundaries through manipulated external references.
public class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>Vulnerabilities classified as CWE-610 (资源在另一范围的外部可控制索引) represent 45 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.