目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-272 最小特权原则违背 类漏洞列表 34

CWE-272 最小特权原则违背 类弱点 34 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-272 属于权限管理缺陷，指程序在执行需高权限的操作（如 chroot）后未及时降低权限。攻击者可利用此漏洞，在特权窗口期内执行恶意代码或访问敏感资源，从而提升权限并控制系统。开发者应避免长期持有高权限，确保特权操作完成后立即恢复至最小必要权限，严格遵循最小权限原则以缩小攻击面。

MITRE CWE 官方描述
CWE：CWE-272 最小权限违规 英文：执行 chroot() 等操作所需的提升权限级别应在操作完成后立即撤销。
常见影响 (1)
Access Control, Confidentiality Gain Privileges or Assume Identity, Read Application Data, Read Files or Directories
An attacker may be able to access resources with the elevated privilege that could not be accessed with the attacker's original privileges. This is particularly likely in conjunction with another flaw, such as a buffer overflow.
缓解措施 (3)
Architecture and Design, Operation Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
代码示例 (2)
The following example demonstrates the weakness.
setuid(0); // Do some important stuff setuid(old_uid); // Do some non privileged stuff.
Bad · C
The following example demonstrates the weakness.
AccessController.doPrivileged(new PrivilegedAction() { public Object run() { // privileged code goes here, for example: System.loadLibrary("awt"); return null; // nothing to return }
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2024-0798 AnythingLLM 安全漏洞 — mintplex-labs/anything-llm 4.9 - 2024-02-25
CVE-2023-32451 Dell Display Manager 安全漏洞 — Dell Display Manager 7.3 High 2024-02-06
CVE-2023-28047 Dell Display Manager 安全漏洞 — Dell Display Manager 7.3 High 2023-04-20
CVE-2023-28046 Dell Display Manager 安全漏洞 — Dell Display Manager 6.6 Medium 2023-04-06

CWE-272（最小特权原则违背） 是常见的弱点类别，本平台收录该类弱点关联的 34 条 CVE 漏洞。