CWE-284 访问控制不恰当 类弱点 2613 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-284 属于访问控制缺陷漏洞，指产品未正确限制或完全未限制非授权主体对资源的访问。攻击者通常通过绕过身份验证或权限检查，直接访问敏感数据或执行特权操作。开发者应避免此类问题，需严格实施身份认证与授权机制，确保仅合法用户能访问特定资源，并记录操作日志以增强可追溯性，从而有效防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Truefunction runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-23446 | Elastic 安全漏洞 — Kibana | 6.5 | Medium | 2024-02-07 |
| CVE-2023-32479 | Dell 多款产品安全漏洞 — Dell Encryption | 6.7 | Medium | 2024-02-06 |
| CVE-2023-43517 | Qualcomm Chipsets 安全漏洞 — Snapdragon | 8.4 | High | 2024-02-06 |
| CVE-2024-0969 | WordPress plugin ARMember 安全漏洞 — ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup | 5.3 | Medium | 2024-02-05 |
| CVE-2024-0373 | WordPress plugin Views for WPForms 安全漏洞 — Views for WPForms – Display & Edit WPForms Entries on your site frontend | 4.3 | Medium | 2024-02-05 |
| CVE-2024-0366 | WordPress plugin Starbox 安全漏洞 — Starbox – the Author Box for Humans | 4.3 | Medium | 2024-02-05 |
| CVE-2024-0371 | WordPress plugin Views for WPForms 安全漏洞 — Views for WPForms – Display & Edit WPForms Entries on your site frontend | 4.3 | Medium | 2024-02-05 |
| CVE-2024-1092 | WordPress plugin RSS Aggregator by Feedzy 安全漏洞 — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | 4.3 | Medium | 2024-02-05 |
| CVE-2024-0370 | WordPress plugin Views for WPForms 安全漏洞 — Views for WPForms – Display & Edit WPForms Entries on your site frontend | 4.3 | Medium | 2024-02-05 |
| CVE-2024-0374 | WordPress plugin Views for WPForms 安全漏洞 — Views for WPForms – Display & Edit WPForms Entries on your site frontend | 4.3 | Medium | 2024-02-05 |
| CVE-2024-0324 | WordPress Plugin User Profile Builder 安全漏洞 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 8.2 | High | 2024-02-05 |
| CVE-2024-22202 | phpMyFAQ 访问控制错误漏洞 — phpMyFAQ | 5.7 | Medium | 2024-02-05 |
| CVE-2023-38263 | IBM QRadar SOAR Plug-in 访问控制错误漏洞 — SOAR QRadar Plugin App | 6.5 | Medium | 2024-02-02 |
| CVE-2023-32333 | IBM Maximo Asset Management 访问控制错误漏洞 — Maximo Asset Management | 6.5 | Medium | 2024-02-02 |
| CVE-2023-47867 | MachineSense FeverWarn 访问控制错误漏洞 — FeverWarn | 8.8 | High | 2024-02-01 |
| CVE-2024-1114 | openBI 访问控制错误漏洞 — openBI | 6.5 | Medium | 2024-01-31 |
| CVE-2024-24566 | Lobe Chat 安全漏洞 — lobe-chat | 5.3 | Medium | 2024-01-31 |
| CVE-2024-21653 | vantage6 访问控制错误漏洞 — vantage6 | 6.5 | Medium | 2024-01-30 |
| CVE-2024-1011 | SourceCodester Employee Management System 访问控制错误漏洞 — Employee Management System | 4.3 | Medium | 2024-01-29 |
| CVE-2024-0212 | Wordpress plugin Cloudflare 安全漏洞 — Cloudflare-WordPress | 8.1 | High | 2024-01-29 |
| CVE-2024-20263 | Cisco Small Business 安全漏洞 — Cisco Small Business Smart and Managed Switches | 5.8 | Medium | 2024-01-26 |
| CVE-2024-23675 | Splunk 安全漏洞 — Splunk Enterprise | 6.5 | Medium | 2024-01-22 |
| CVE-2024-23681 | Artemis Java Test Sandbox 安全漏洞 | 8.6 | - | 2024-01-19 |
| CVE-2024-0712 | Beijing Baichuo Smart S150 访问控制错误漏洞 — Smart S150 Management Platform | 7.3 | High | 2024-01-19 |
| CVE-2023-20260 | Cisco Evolved Programmable Network Manager和Cisco Prime Infrastructure安全漏洞 — Cisco Prime Infrastructure | 6.0 | Medium | 2024-01-17 |
| CVE-2024-0642 | C21 Live encoder 访问控制错误漏洞 — C21 Live Encoder and Live Mosaic | 9.8 | Critical | 2024-01-17 |
| CVE-2024-22407 | Shopware 访问控制错误漏洞 — shopware | 4.9 | Medium | 2024-01-16 |
| CVE-2024-0570 | TOTOLINK N350RT 安全漏洞 — N350RT | 7.3 | High | 2024-01-16 |
| CVE-2024-22209 | EDX Open edX 访问控制错误漏洞 — edx-platform | 6.4 | Medium | 2024-01-13 |
| CVE-2023-49099 | Discourse 访问控制错误漏洞 — discourse | 3.1 | Low | 2024-01-12 |
CWE-284（访问控制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 2613 条 CVE 漏洞。