CWE-269 特权管理不恰当 类弱点 1472 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-0221 | Trellix Application and Change Control 安全漏洞 — Application and Change Control | 4.4 | Medium | 2023-01-13 |
| CVE-2022-4294 | AVG Technologies AVG Antivirus 安全漏洞 — Norton Antivirus Windows Eraser Engine | 7.1 | High | 2023-01-10 |
| CVE-2022-46172 | authentik 安全漏洞 — authentik | 6.4 | Medium | 2022-12-28 |
| CVE-2022-4808 | memos 安全漏洞 — usememos/memos | 8.1 | - | 2022-12-28 |
| CVE-2022-38757 | Micro Focus ZENworks 安全漏洞 — ZENworks Configuration Management (ZCM) | 7.2 | High | 2022-12-23 |
| CVE-2022-38060 | OpenStack 代码问题漏洞 — OpenStack | 8.8 | High | 2022-12-21 |
| CVE-2022-38065 | OpenStack 安全漏洞 — OpenStack | 8.8 | - | 2022-12-21 |
| CVE-2022-46334 | Proofpoint Enterprise Protection 安全漏洞 — enterprise_protection | 7.8 | High | 2022-12-21 |
| CVE-2022-41268 | 多款产品安全漏洞 — Business Planning and Consolidation | 8.5 | High | 2022-12-13 |
| CVE-2022-23485 | Mobileiron Sentry 安全漏洞 — sentry | 6.4 | Medium | 2022-12-10 |
| CVE-2022-4264 | M-Files Web 安全漏洞 — M-Files Web | 6.5 | Medium | 2022-12-09 |
| CVE-2022-41948 | DHIS 2 安全漏洞 — dhis2-core | 6.7 | Medium | 2022-12-08 |
| CVE-2022-42888 | WordPress plugin ARMember 安全漏洞 — ARMember | 9.8 | Critical | 2022-12-06 |
| CVE-2022-4314 | Rdiffweb 安全漏洞 — ikus060/rdiffweb | 9.8 | - | 2022-12-06 |
| CVE-2022-4173 | AVG Technologies AVG Antivirus 安全漏洞 — Avast and AVG Antivirus | 7.3 | High | 2022-12-05 |
| CVE-2022-4270 | M-Files Web 安全漏洞 — M-Files Web | 2.0 | Low | 2022-12-02 |
| CVE-2022-23737 | GitHub Enterprise Server 安全漏洞 — GitHub Enterprise Server | 6.5 | - | 2022-12-01 |
| CVE-2022-1606 | M-Files Server 安全漏洞 — M-Files Server | 2.4 | Low | 2022-11-30 |
| CVE-2022-41923 | Grails 安全漏洞 — grails-spring-security-core | 9.1 | Critical | 2022-11-23 |
| CVE-2022-0222 | Schneider Electric Modicon M340 安全漏洞 — Modicon M340 CPUs | 7.5 | High | 2022-11-22 |
| CVE-2022-39395 | Vela 安全漏洞 — server | 9.6 | Critical | 2022-11-10 |
| CVE-2021-34579 | Phoenix Contact FL MGUARD DM 安全漏洞 — FL MGUARD DM (2981974) | 7.5 | High | 2022-11-09 |
| CVE-2022-44733 | Acronis Cyber Protect 安全漏洞 — Acronis Cyber Protect Home Office | 7.8 | - | 2022-11-07 |
| CVE-2022-44732 | Acronis Cyber Protect 安全漏洞 — Acronis Cyber Protect Home Office | 7.8 | - | 2022-11-07 |
| CVE-2022-3369 | 多款Bitdefender产品访问控制错误漏洞 — Engines | 8.6 | High | 2022-11-01 |
| CVE-2022-3419 | WordPress plugin Automatic User Roles Switcher 安全漏洞 — Automatic User Roles Switcher | 6.5 | - | 2022-10-31 |
| CVE-2022-43749 | Synology Presto File Server 安全漏洞 — Presto File Server | 4.3 | Medium | 2022-10-26 |
| CVE-2022-39286 | Jupyter Notebook 代码问题漏洞 — jupyter_core | 8.8 | High | 2022-10-26 |
| CVE-2022-41835 | F5 F5OS-A 安全漏洞 — F5OS-A | 7.3 | High | 2022-10-19 |
| CVE-2022-2249 | Avaya Aura Communication Manager 安全漏洞 — Avaya Aura Communication Manager | 7.7 | High | 2022-10-12 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1472 条 CVE 漏洞。