CWE-284 访问控制不恰当 类弱点 2613 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-284 属于访问控制缺陷漏洞，指产品未正确限制或完全未限制非授权主体对资源的访问。攻击者通常通过绕过身份验证或权限检查，直接访问敏感数据或执行特权操作。开发者应避免此类问题，需严格实施身份认证与授权机制，确保仅合法用户能访问特定资源，并记录操作日志以增强可追溯性，从而有效防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Truefunction runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-24568 | Suricata 安全漏洞 — suricata | 5.3 | Medium | 2024-02-26 |
| CVE-2024-1823 | CodeAstro Simple Voting System 访问控制错误漏洞 — Simple Voting System | 5.3 | Medium | 2024-02-23 |
| CVE-2024-1053 | WordPress Plugin Event Tickets and Registration 安全漏洞 — Event Tickets and Registration | 4.3 | Medium | 2024-02-22 |
| CVE-2024-20325 | Cisco Unified Intelligence Center 安全漏洞 — Cisco Unified Intelligence Center | 5.1 | Medium | 2024-02-21 |
| CVE-2024-1701 | PHP MySQL User Signup Login System 访问控制错误漏洞 — PHP-MYSQL-User-Login-System | 5.3 | Medium | 2024-02-21 |
| CVE-2024-1294 | WordPress Plugin Sunshine Photo Cart: Free Client Galleries for Photographers 安全漏洞 — Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | 5.3 | Medium | 2024-02-20 |
| CVE-2024-1288 | WordPress Plugin Schema & Structured Data for WP & AMP 安全漏洞 — Schema & Structured Data for WP & AMP | 4.3 | Medium | 2024-02-20 |
| CVE-2024-0978 | WordPress Plugin My Private Site plugin for WordPress 安全漏洞 — My Private Site | 5.3 | Medium | 2024-02-20 |
| CVE-2024-1472 | WordPress Plugin WP Maintenance 安全漏洞 — WP Maintenance | 5.3 | Medium | 2024-02-20 |
| CVE-2024-1492 | WordPress Plugin WPify Woo Czech 安全漏洞 — WPify Woo Czech | 5.3 | Medium | 2024-02-20 |
| CVE-2024-1475 | WordPress Plugin Coming Soon Maintenance Mode 安全漏洞 — Coming Soon Maintenance Mode | 5.3 | Medium | 2024-02-20 |
| CVE-2024-1044 | WordPress Plugin Customer Reviews for WooCommerce 安全漏洞 — Customer Reviews for WooCommerce | 5.3 | Medium | 2024-02-20 |
| CVE-2023-50257 | eProsima Fast DDS 访问控制错误漏洞 — Fast-DDS | 9.7 | Critical | 2024-02-19 |
| CVE-2024-25981 | Moodle 安全漏洞 | 4.3 | Medium | 2024-02-19 |
| CVE-2024-25980 | moodle 安全漏洞 | 4.3 | Medium | 2024-02-19 |
| CVE-2024-1343 | LaborOfficeFree 访问控制错误漏洞 — LaborOfficeFree | 4.7 | Medium | 2024-02-19 |
| CVE-2023-39244 | Dell Enterprise Storage Integrator 访问控制错误漏洞 — ESI (Enterprise Storage Integrator) for SAP LAMA | 7.3 | High | 2024-02-15 |
| CVE-2023-44283 | Dell SupportAssist for Home PCs 访问控制错误漏洞 — SupportAssist for Home PCs | 7.8 | High | 2024-02-14 |
| CVE-2024-24751 | sf_event_mgt 安全漏洞 — sf_event_mgt | 4.3 | Medium | 2024-02-13 |
| CVE-2024-21376 | Microsoft Azure Kubernetes 安全漏洞 — Azure Kubernetes Service | 9.0 | Critical | 2024-02-13 |
| CVE-2024-21364 | Microsoft Azure Site Recovery 安全漏洞 — Azure Site Recovery | 9.3 | Critical | 2024-02-13 |
| CVE-2024-20695 | Microsoft Skype for Business 安全漏洞 — Skype for Business Server 2019 CU7 | 5.7 | Medium | 2024-02-13 |
| CVE-2024-21401 | Microsoft Azure Active Directory 安全漏洞 — Entra | 9.8 | Critical | 2024-02-13 |
| CVE-2024-1439 | Moodle 访问控制错误漏洞 — LMS | 6.5 | Medium | 2024-02-12 |
| CVE-2024-24776 | Mattermost 安全漏洞 — Mattermost | 3.1 | Low | 2024-02-09 |
| CVE-2024-25106 | OpenObserve 安全漏洞 — openobserve | 9.1 | Critical | 2024-02-08 |
| CVE-2024-0965 | WordPress Plugin Simple Page Access Restriction 安全漏洞 — Simple Page Access Restriction | 5.3 | Medium | 2024-02-08 |
| CVE-2024-24824 | Graylog 安全漏洞 — graylog2-server | 8.8 | High | 2024-02-07 |
| CVE-2024-24771 | Open Forms 安全漏洞 — open-forms | 7.7 | High | 2024-02-07 |
| CVE-2024-23447 | Elastic Network Drive Connector 安全漏洞 — Elastic Network Drive Connector | 5.3 | Medium | 2024-02-07 |
CWE-284（访问控制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 2613 条 CVE 漏洞。