CWE-284 访问控制不恰当 类弱点 2613 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-284 属于访问控制缺陷漏洞，指产品未正确限制或完全未限制非授权主体对资源的访问。攻击者通常通过绕过身份验证或权限检查，直接访问敏感数据或执行特权操作。开发者应避免此类问题，需严格实施身份认证与授权机制，确保仅合法用户能访问特定资源，并记录操作日志以增强可追溯性，从而有效防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Truefunction runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-0369 | WordPress Plugin Bulk Edit Post Titles 安全漏洞 — Bulk Edit Post Titles | 4.3 | Medium | 2024-03-13 |
| CVE-2024-0631 | WordPress Plugin Duitku Payment Gateway 安全漏洞 — Duitku Payment Gateway | 5.3 | Medium | 2024-03-13 |
| CVE-2023-6785 | WordPress Plugin Download Manager 安全漏洞 — Download Manager | 5.3 | Medium | 2024-03-13 |
| CVE-2024-1462 | WordPress Plugin Maintenance Page 安全漏洞 — Maintenance Page | 5.3 | Medium | 2024-03-13 |
| CVE-2024-1370 | WordPress Plugin Maintenance Page 安全漏洞 — Maintenance Page | 5.3 | Medium | 2024-03-13 |
| CVE-2024-21436 | Microsoft Windows Installer 安全漏洞 — Windows 10 Version 1809 | 7.8 | High | 2024-03-12 |
| CVE-2024-26201 | Microsoft Intune 安全漏洞 — Intune Company Portal for Android | 6.6 | Medium | 2024-03-12 |
| CVE-2024-26203 | Microsoft Azure Data Studio 安全漏洞 — Azure Data Studio | 7.3 | High | 2024-03-12 |
| CVE-2024-21418 | Microsoft Software for Open Networking in the Cloud (SONiC) 安全漏洞 — Software for Open Networking in the Cloud (SONiC) | 7.8 | High | 2024-03-12 |
| CVE-2023-36554 | Fortinet FortiManager 访问控制错误漏洞 — FortiManager | 7.7 | High | 2024-03-12 |
| CVE-2022-32257 | Siemens SINEMA Remote Connect Server 访问控制错误漏洞 — SINEMA Remote Connect Server | 9.8 | Critical | 2024-03-12 |
| CVE-2024-21483 | Siemens SENTRON 7KM PAC 访问控制错误漏洞 — SENTRON 7KM PAC3120 AC/DC | 4.6 | Medium | 2024-03-12 |
| CVE-2024-28120 | codeium-chrome 安全漏洞 — codeium-chrome | 6.5 | Medium | 2024-03-11 |
| CVE-2024-2281 | Automated-Mess-Management-System 访问控制错误漏洞 — Automated-Mess-Management-System | 6.3 | Medium | 2024-03-08 |
| CVE-2024-28115 | FreeRTOS-Kernel 安全漏洞 — FreeRTOS-Kernel | 8.8 | High | 2024-03-07 |
| CVE-2024-1088 | WordPress Plugin Password Protected Store for WooCommerce 安全漏洞 — Password Protected Store for WooCommerce | 5.3 | Medium | 2024-03-05 |
| CVE-2024-1478 | WordPress Plugin Maintenance Mode 安全漏洞 — Maintenance Mode | 5.3 | Medium | 2024-03-05 |
| CVE-2024-0795 | AnythingLLM 访问控制错误漏洞 — mintplex-labs/anything-llm | 9.8 | - | 2024-03-02 |
| CVE-2024-21767 | Commend WS203VICM 访问控制错误漏洞 — WS203VICM | 9.4 | Critical | 2024-03-01 |
| CVE-2024-1942 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2024-02-29 |
| CVE-2024-1888 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2024-02-29 |
| CVE-2024-1887 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2024-02-29 |
| CVE-2024-23488 | Mattermost 安全漏洞 — Mattermost | 3.1 | Low | 2024-02-29 |
| CVE-2024-20291 | Cisco Nexus 3000 Series Switches 安全漏洞 — Cisco NX-OS Software | 5.8 | Medium | 2024-02-28 |
| CVE-2024-1632 | Progress Sitefinity 安全漏洞 — Sitefinity | 8.8 | High | 2024-02-28 |
| CVE-2024-1476 | WordPress Plugin Under Construction / Maintenance Mode from Acurax 安全漏洞 — Under Construction / Maintenance Mode from Acurax | 5.3 | Medium | 2024-02-28 |
| CVE-2024-0766 | WordPress Plugin Elementor Templates & Widgets for WooCommerce 安全漏洞 — Envo's Templates & Widgets for Elementor and WooCommerce | 4.3 | Medium | 2024-02-28 |
| CVE-2024-0975 | WordPress Plugin WordPress Access Control 安全漏洞 — WordPress Access Control | 5.3 | Medium | 2024-02-28 |
| CVE-2024-22459 | Dell ECS 访问控制错误漏洞 — ECS | 6.8 | Medium | 2024-02-28 |
| CVE-2024-0551 | AnythingLLM 访问控制错误漏洞 — mintplex-labs/anything-llm | 7.1 | - | 2024-02-27 |
CWE-284（访问控制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 2613 条 CVE 漏洞。