CWE-918 服务端请求伪造(SSRF) 类弱点 2037 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-28627 | Adobe Experience Manager 代码问题漏洞 — Experience Manager | 5.4 | Medium | 2021-08-24 |
| CVE-2021-37711 | Shopware 代码问题漏洞 — platform | 8.8 | High | 2021-08-16 |
| CVE-2021-24472 | WordPress 插件代码问题漏洞 — QT KenthaRadio | 9.8 | - | 2021-08-02 |
| CVE-2021-24371 | WordPress Plugin RSVPMaker 代码问题漏洞 — RSVPMaker | 2.7 | - | 2021-08-02 |
| CVE-2021-22726 | EVlink City、EVlink Parking 和 EVlink Smart Wallbox 代码问题漏洞 — EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) | 9.1 | - | 2021-07-21 |
| CVE-2021-29102 | Esri Arcgis Server 代码问题漏洞 — ArcGIS Server | 7.5 | - | 2021-07-11 |
| CVE-2021-32639 | Emissary 代码问题漏洞 — emissary | 7.2 | High | 2021-07-02 |
| CVE-2021-32698 | Elabftw 代码问题漏洞 — elabftw | 6.8 | Medium | 2021-06-21 |
| CVE-2021-34808 | Synology Media Server 代码问题漏洞 — Media Server | 5.8 | Medium | 2021-06-18 |
| CVE-2021-34811 | Synology Download Station 代码问题漏洞 — Download Station | 5.0 | Medium | 2021-06-18 |
| CVE-2021-32682 | elFinder 代码问题漏洞 — elFinder | 9.8 | Critical | 2021-06-14 |
| CVE-2021-33181 | Synology Video Station Video Station 代码问题漏洞 — Synology Video Station | 6.6 | Medium | 2021-06-01 |
| CVE-2021-33184 | Synology Download Station 代码问题漏洞 — Synology Download Station | 7.7 | High | 2021-06-01 |
| CVE-2021-25640 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 8.2 | - | 2021-05-31 |
| CVE-2020-14328 | Red Hat Ansible 代码问题漏洞 — Tower | 5.5 | - | 2021-05-27 |
| CVE-2020-14327 | Red Hat Ansible 代码问题漏洞 — Tower | 5.5 | - | 2021-05-27 |
| CVE-2021-29490 | Jellyfin 代码问题漏洞 — jellyfin | 5.8 | Medium | 2021-05-05 |
| CVE-2021-27905 | Apache Solr 代码问题漏洞 — Apache Solr | 9.1 | - | 2021-04-13 |
| CVE-2021-24150 | WordPress Like Button Rating 代码问题漏洞 — Like Button Rating ♥ LikeBtn | 7.5 | - | 2021-04-05 |
| CVE-2021-22696 | Apache CXF 代码问题漏洞 — Apache CXF | 9.1 | - | 2021-04-02 |
| CVE-2020-12529 | MB CONNECT LINE mymbCONNECT24e 代码问题漏洞 — mymbCONNECT24 | 5.8 | Medium | 2021-03-02 |
| CVE-2021-21311 | SOURCEFORGE Adminer 代码问题漏洞 — adminer | 7.2 | High | 2021-02-11 |
| CVE-2021-21288 | CarrierWave 代码问题漏洞 — carrierwave | 4.3 | Medium | 2021-02-08 |
| CVE-2021-21287 | Minio MinIO 代码问题漏洞 — minio | 7.7 | High | 2021-02-01 |
| CVE-2021-1272 | Cisco Data Center Network Manager 代码问题漏洞 — Cisco Data Center Network Manager | 8.8 | High | 2021-01-20 |
| CVE-2021-21009 | Adobe Campaign Classic 代码问题漏洞 — Campaign | 8.6 | High | 2021-01-13 |
| CVE-2020-26258 | XStream 代码问题漏洞 — xstream | 6.3 | Medium | 2020-12-16 |
| CVE-2020-10770 | 红帽 Red Hat Keycloak 代码问题漏洞 — keycloak | 5.3 | - | 2020-12-15 |
| CVE-2020-17513 | Apache Airflow 代码问题漏洞 — Apache Airflow | 5.3 | - | 2020-12-14 |
| CVE-2020-24444 | Adobe Experience Manager 代码问题漏洞 — Experience Manager | 5.8 | Medium | 2020-12-10 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2037 条 CVE 漏洞。