新华三主动安全 2021 年 网络安全漏洞态势报告 新华三信息安全技术有限公司 新华三攻防实验室 2022年3月 目 录 1 概述 ····························································································································· 3 1.1 漏洞增长趋势 ·················································································································· 3 1.2 攻击总体态势 ·················································································································· 4 2 Web 应用漏洞 ················································································································· 7 2.1 漏洞分类 ························································································································ 8 2.2、重点漏洞回顾 ················································································································· 9 2.2 攻击态势分析 ················································································································ 11 3 操作系统漏洞 ················································································································11 3.1 漏洞分类 ······················································································································ 12 3.2 重点漏洞回顾 ················································································································ 13 3.3 攻击态势分析 ················································································································ 15 4 网络设备漏洞 ················································································································17 5 漏洞分类 ······················································································································17 5.1 重点漏洞回顾 ················································································································ 18 5.2 攻击态势分析 ················································································································ 19 6 数据库漏洞 ···················································································································20 6.1 漏洞分类 ······················································································································ 20 6.2 重点漏洞回顾 ················································································································ 21 6.3 攻击态势分析 ················································································································ 22 7 工控系统漏洞 ················································································································23 7.1 漏洞分类 ······················································································································ 23 7.2 重点漏洞回顾 ················································································································ 24 7.3 攻击态势分析 ················································································································ 25 8 云计算平台漏洞 ·············································································································25 8.1 漏洞分类 ······················································································································ 26 8.2 重点漏洞回顾 ················································································································ 27 8.3 攻击态势分析 ················································································································ 28 9 总结与建议 ···················································································································29 9.1 总结 ····························································································································· 29 9.2 安全建议 ······················································································································ 29 10 结语 ···························································································································33 2021 年网络安全漏洞态势报告 新华三攻防实验室持续关注国内外网络安全漏洞和态势，协同高级威胁分析、漏洞分析、威胁情报 分析等领域专家一同发布《2021 年网络安全漏洞态势报告》。报告开篇概述了 2021 年漏洞和攻击 的总体趋势，正文从 Web 应用、操作系统、网络设备、数据库、工控系统、云计算平台多个角度分 析了漏洞分布和攻击态势。本报告试图以观察者的视角剖析 2021 年网络安全领域新增漏洞情况以 及演变趋势，希望为各行业及相关企事业单位的网络安全建设提供参考和帮助。 1 概述 1.1 漏洞增长趋势 2021 年新华三收录的漏洞总数为 20203 条，其中超危漏洞 2591 条，高危漏洞 8451 条，如图 1 所 示，超危与高危漏洞占比 50%以上，如图 2 所示，高危以上漏洞比 2020 年增长 14.3%。2016 年 至 2021 年漏洞总体呈逐年增长趋势，其中高危以上漏洞逐年增长比例超过 10%。 10000 25000 9000 20203 20000 8000 17