目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1220 类漏洞列表 105

CWE-1220 类弱点 105 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1220 属于访问控制粒度不足漏洞。当访问控制策略过于宽泛，未能精确区分受信任与未受信任的代理时，攻击者可利用此缺陷访问敏感资产。开发者应实施最小权限原则，细化访问控制策略，确保仅授予必要的读写权限，从而防止未授权访问，提升系统安全性。

MITRE CWE 官方描述
CWE：CWE-1220 访问控制粒度不足 英文：产品通过策略或其他功能实施访问控制，旨在禁用或限制来自不受信任代理对系统中资产的访问（读取和/或写入）。然而，实施的访问控制缺乏所需的粒度，导致控制策略过于宽泛，因为它允许未经授权的代理访问安全敏感的资产。 集成电路和硬件引擎可以向受信任的固件或软件模块（通常由 BIOS/引导加载程序设置）暴露对资产（设备配置、密钥等）的访问。此类访问通常受到访问控制。在电源重置后，硬件或系统通常以寄存器中的默认值启动，受信任的固件（引导固件）配置必要的访问控制保护。此类保护方案中可能存在的一个常见弱点是访问控制或策略的粒度不够细。这种状况允许超出受信任代理范围的代理访问资产，可能导致功能丧失或无法安全地设置设备。这进一步导致从泄露的敏感密钥材料到设备配置被修改的安全风险。
常见影响 (1)
Confidentiality, Integrity, Availability, Access Control Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Other
缓解措施 (1)
Architecture and Design, Implementation, Testing Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
Effectiveness: High
代码示例 (2)
Consider a system with a register for storing AES key for encryption or decryption. The key is 128 bits, implemented as a set of four 32-bit registers. The key registers are assets and registers, AES_KEY_READ_POLICY and AES_KEY_WRITE_POLICY, and are defined to provide necessary access controls. The read-policy register defines which agents can read the AES-key registers, and write-policy register …
Register Field description AES_ENC_DEC_KEY_0 AES key [0:31] for encryption or decryption Default 0x00000000 AES_ENC_DEC_KEY_1 AES key [32:63] for encryption or decryption Default 0x00000000 AES_ENC_DEC_KEY_2 AES key [64:95] for encryption or decryption Default 0x00000000 AES_ENC_DEC_KEY_4 AES key [96:127] for encryption or decryption Default 0x00000000 AES_KEY_READ_WRITE_POLICY [31:0] Default 0x00000006 - meaning agent with identities "1" and "2" can both read from and write to key registers
Bad · Other
AES_KEY_READ_POLICY [31:0] Default 0x00000002 - meaning only Crypto engine with identity "1" can read registers: AES_ENC_DEC_KEY_0, AES_ENC_DEC_KEY_1, AES_ENC_DEC_KEY_2, AES_ENC_DEC_KEY_3 AES_KEY_WRITE_POLICY [31:0] Default 0x00000004 - meaning only trusted firmware with identity "2" can program registers: AES_ENC_DEC_KEY_0, AES_ENC_DEC_KEY_1, AES_ENC_DEC_KEY_2, AES_ENC_DEC_KEY_3
Good · Other
Within the AXI node interface wrapper module in the RISC-V AXI module of the HACK@DAC'19 CVA6 SoC [REF-1346], an access control mechanism is employed to regulate the access of different privileged users to peripherals.
... for (i=0; i<NB_SUBORDINATE; i++) begin for (j=0; j<NB_MANAGER; j++) begin assign connectivity_map_o[i][j] = access_ctrl_i[i][j][priv_lvl_i] || ((j==6) && access_ctrl_i[i][7][priv_lvl_i]); end end ...
Bad · Verilog
... for (i=0; i<NB_SUBORDINATE; i++) begin for (j=0; j<NB_MANAGER; j++) begin assign connectivity_map_o[i][j] = access_ctrl_i[i][j][priv_lvl_i]; end end ...
Good · Verilog
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-96372 Drupal Webform 访问绕过漏洞 — Webform - - 2026-10-22
CVE-2026-85316 Apache Camel HTTP 平台意外代理模式漏洞 — Apache Camel 4.8 Medium 2026-10-19
CVE-2026-111885 phpMyFAQ 4.2.0 删除组接口未授权访问漏洞 — phpMyFAQ 5.5 Medium 2026-10-17
CVE-2026-103509 P4搜索配置API凭证泄露漏洞 — P4 (Helix core) 8.5 High 2026-10-15
CVE-2026-70216 Windows移动设备管理篡改漏洞 — Windows 10 Version 1607 5.5 Medium 2026-10-13
CVE-2026-81969 Windows Server Update Service 提权漏洞 — Windows 10 Version 1607 7.8 High 2026-10-13
CVE-2026-83499 Windows Server Update Service 权限提升漏洞 — Windows 10 Version 1607 7.8 High 2026-10-13
CVE-2026-70218 Windows StateRepository API 提权漏洞 — Windows 11 Version 24H2 7.8 High 2026-10-13
CVE-2026-14210 GitLab 访问控制粒度不足漏洞 — GitLab 4.3 Medium 2026-10-13
CVE-2026-86338 Ash 字段策略过滤缺陷信息泄露漏洞 — ash 6.0 Medium 2026-09-16
CVE-2026-77480 Microsoft SQL Server 权限许可和访问控制问题漏洞 — Microsoft SQL Server 2017 (CU 31) 8.8 High 2026-09-08
CVE-2026-66814 Microsoft SQL Server 权限许可和访问控制问题漏洞 — Microsoft SQL Server 2017 (CU 31) 8.8 High 2026-09-08
CVE-2026-69267 Microsoft Windows Connected User Experiences 权限许可和访问控制问题漏洞 — Windows 10 Version 1809 6.5 Medium 2026-09-08
CVE-2026-78216 Ash Framework AshLua 权限许可和访问控制问题漏洞 — ash_lua 6.0 Medium 2026-09-08
CVE-2026-78230 Ash Framework Ash AI 权限许可和访问控制问题漏洞 — ash_ai 6.0 Medium 2026-09-08
CVE-2026-15431 HP Support Assistant 权限许可和访问控制问题漏洞 — HP Support Assistant 7.3 High 2026-09-03
CVE-2026-78122 Tecnativa Docker Socket Proxy 权限许可和访问控制问题漏洞 — docker-socket-proxy 7.4 High 2026-08-22
CVE-2026-40145 BeyondTrust Endpoint Privilege Management 权限许可和访问控制问题漏洞 — Endpoint Privilege Management (Windows deployment) 7.1 High 2026-08-17
CVE-2026-68868 Apache Airflow 权限许可和访问控制问题漏洞 — Apache Airflow Google provider - - 2026-08-12
CVE-2026-62721 Microsoft Windows 权限许可和访问控制问题漏洞 — Windows 10 Version 1607 7.8 High 2026-08-11
CVE-2026-16560 389 Directory Server 权限许可和访问控制问题漏洞 — Red Hat Directory Server 11 5.3 Medium 2026-07-22
CVE-2026-16106 Red Hat Build of Keycloak 授权问题漏洞 — Red Hat build of Keycloak 26.6 4.9 Medium 2026-07-17
CVE-2026-16108 Red Hat Build of Keycloak 安全漏洞 — Red Hat build of Keycloak 26.6 4.3 Medium 2026-07-17
CVE-2026-50502 Microsoft Windows Event Logging Service 权限许可和访问控制问题漏洞 — Windows 10 Version 1607 8.0 High 2026-07-14
CVE-2026-50405 Microsoft Windows 权限许可和访问控制问题漏洞 — Windows 10 Version 1607 7.8 High 2026-07-14
CVE-2026-48581 Microsoft Surface 权限许可和访问控制问题漏洞 — Microsoft Surface Go 7.8 High 2026-07-14
CVE-2026-56155 Microsoft Active Directory Federation Services 权限许可和访问控制问题漏洞 — Windows 10 Version 1607 7.8 High 2026-07-14
CVE-2026-55006 Microsoft Exchange Server 权限许可和访问控制问题漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 7.8 High 2026-07-14
CVE-2026-49170 Microsoft Windows StateRepository API 权限许可和访问控制问题漏洞 — Windows 10 Version 1809 7.8 High 2026-07-14
CVE-2026-14615 Keycloak 权限许可和访问控制问题漏洞 — Red Hat build of Keycloak 26.4 4.3 Medium 2026-07-03

CWE-1220 是常见的弱点类别，本平台收录该类弱点关联的 105 条 CVE 漏洞。