CWE-284 访问控制不恰当 类弱点 2614 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-284 属于访问控制缺陷漏洞，指产品未正确限制或完全未限制非授权主体对资源的访问。攻击者通常通过绕过身份验证或权限检查，直接访问敏感数据或执行特权操作。开发者应避免此类问题，需严格实施身份认证与授权机制，确保仅合法用户能访问特定资源，并记录操作日志以增强可追溯性，从而有效防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Truefunction runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-24309 | Siemens Mendix 安全漏洞 — Mendix Runtime V7 | 6.8 | Medium | 2022-03-08 |
| CVE-2021-41543 | Siemens Climatix Pol909 日志信息泄露漏洞 — Climatix POL909 (AWB module) | 6.5 | - | 2022-03-08 |
| CVE-2021-46270 | JFrog Artifactory 安全漏洞 — JFrog Artifactory | 2.7 | Low | 2022-03-02 |
| CVE-2021-45074 | JFrog Artifactory 安全漏洞 — JFrog Artifactory | 4.3 | Medium | 2022-03-02 |
| CVE-2022-0824 | Webmin 访问控制错误漏洞 — webmin/webmin | 8.8 | - | 2022-03-02 |
| CVE-2021-24688 | Wordpress Plugin Orange Form 跨站请求伪造漏洞 — Orange Form | 4.3 | - | 2022-02-28 |
| CVE-2021-3967 | Zulip 安全漏洞 — zulip/zulip | 8.8 | - | 2022-02-26 |
| CVE-2020-14504 | Rockwell Automation 1734-AENTR 授权问题漏洞 — 1734-AENTR | 7.5 | - | 2022-02-24 |
| CVE-2022-0732 | TheSpyApp 访问控制错误漏洞 — Copy9 | 7.5 | - | 2022-02-24 |
| CVE-2022-0731 | Dolibarr 访问控制错误漏洞 — dolibarr/dolibarr | 7.1 | - | 2022-02-23 |
| CVE-2022-0727 | PeerTube 访问控制错误漏洞 — chocobozzz/peertube | 5.4 | - | 2022-02-23 |
| CVE-2022-23981 | WordPress Plugin 访问控制错误漏洞 — Perfect Brands for WooCommerce (WordPress plugin) | 4.3 | Medium | 2022-02-18 |
| CVE-2021-4201 | ForgeRock Access Management授权问题漏洞 — Access Management | 9.6 | Critical | 2022-02-14 |
| CVE-2022-24924 | Google Android 安全漏洞 — LiveWallpaper | 2.2 | Low | 2022-02-11 |
| CVE-2022-24923 | Google Android 安全漏洞 — SearchWidget | 4.0 | Medium | 2022-02-11 |
| CVE-2022-23997 | Samsung Wear Os 安全漏洞 — Samsung Wearable Devices | 4.0 | Medium | 2022-02-11 |
| CVE-2022-23996 | Samsung Wear Os 访问控制错误漏洞 — Samsung Wearable Devices | 4.0 | Medium | 2022-02-11 |
| CVE-2022-23994 | SAMSUNG Wear Os 安全漏洞 — Samsung Wearable Devices | 3.3 | Low | 2022-02-11 |
| CVE-2022-23995 | Samsung Wear OS 访问控制错误漏洞 — Samsung Wearable Devices | 4.0 | Medium | 2022-02-11 |
| CVE-2022-23433 | SAMSUNG Device 安全漏洞 — Reminder | 4.3 | Medium | 2022-02-11 |
| CVE-2020-13677 | Drupal 安全漏洞 — Core | 5.9 | - | 2022-02-11 |
| CVE-2020-13676 | Drupal 访问控制错误漏洞 — Core | 6.5 | - | 2022-02-11 |
| CVE-2020-13675 | Drupal 代码问题漏洞 — Core | 9.1 | - | 2022-02-11 |
| CVE-2022-21825 | Citrix Systems Workspace App 安全漏洞 — Citrix Workspace App for Linux | 7.8 | - | 2022-02-09 |
| CVE-2022-21816 | Nvidia vGPU Software 访问控制错误漏洞 — NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming | 5.5 | Medium | 2022-02-07 |
| CVE-2022-21813 | Nvidia GPU Display Driver for Linux 安全漏洞 — NVIDIA GPU Display Driver | 6.1 | Medium | 2022-02-07 |
| CVE-2021-21964 | Sealevel Systems SeaConnect 370W 访问控制错误漏洞 — Sealevel | 8.6 | - | 2022-02-04 |
| CVE-2021-21965 | Sealevel Systems SeaConnect 370w 授权问题漏洞 — Sealevel | 8.6 | - | 2022-02-04 |
| CVE-2022-0273 | Calibre-Web 访问控制错误漏洞 — janeczku/calibre-web | 6.5 | - | 2022-01-30 |
| CVE-2021-40416 | Reolink Rlc-410W 访问控制错误漏洞 — n/a | 8.8 | - | 2022-01-28 |
CWE-284（访问控制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 2614 条 CVE 漏洞。