CWE-285 授权机制不恰当 类弱点 1213 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-285 属于权限控制缺陷，指系统在访问资源或执行操作时未正确执行授权检查。攻击者常通过篡改请求参数或绕过前端限制，以非授权身份访问敏感数据或执行特权操作。开发者应实施严格的基于角色的访问控制，在服务器端对所有请求进行细粒度权限验证，确保仅允许合法用户执行相应操作，从而杜绝越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-2397 | China Mobile多款产品 安全漏洞 — P22g-CIac | 2.4 | Low | 2025-03-17 |
| CVE-2025-2360 | D-Link DIR-823G 安全漏洞 — DIR-823G | 7.3 | High | 2025-03-17 |
| CVE-2025-2359 | D-Link DIR-823G 安全漏洞 — DIR-823G | 7.3 | High | 2025-03-17 |
| CVE-2025-2345 | IROAD X5 安全漏洞 — Dash Cam X5 | 9.8 | Critical | 2025-03-16 |
| CVE-2025-2320 | springboot-openai-chatgpt 安全漏洞 — springboot-openai-chatgpt | 7.3 | High | 2025-03-14 |
| CVE-2025-24053 | Microsoft Dataverse 授权问题漏洞 — Microsoft Dataverse | 7.2 | High | 2025-03-13 |
| CVE-2025-27602 | Umbraco 安全漏洞 — Umbraco-CMS | 4.9 | Medium | 2025-03-11 |
| CVE-2025-27601 | Umbraco 安全漏洞 — Umbraco-CMS | 4.3 | Medium | 2025-03-11 |
| CVE-2025-2114 | Sixun Shanghui Business Management System 安全漏洞 — Sixun Shanghui Group Business Management System | 3.7 | Low | 2025-03-09 |
| CVE-2024-13552 | WordPress plugin SupportCandy 授权问题漏洞 — SupportCandy – Helpdesk & Customer Support Ticket System | 4.3 | Medium | 2025-03-07 |
| CVE-2025-27509 | Fleet 授权问题漏洞 — fleet | 8.8 | - | 2025-03-06 |
| CVE-2024-13724 | WordPress plugin Wallet System for WooCommerce 授权问题漏洞 — Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | 4.3 | Medium | 2025-03-04 |
| CVE-2024-43051 | Qualcomm Chipsets 授权问题漏洞 — Snapdragon | 5.5 | Medium | 2025-03-03 |
| CVE-2025-1847 | zz 安全漏洞 — zz | 6.3 | Medium | 2025-03-03 |
| CVE-2025-1815 | hrms 安全漏洞 — hrms | 7.3 | High | 2025-03-02 |
| CVE-2025-1806 | Eastnets PaymentSafe 安全漏洞 — PaymentSafe | 4.3 | Medium | 2025-03-01 |
| CVE-2024-47053 | Mautic 授权问题漏洞 — mautic/core | 7.7 | High | 2025-02-26 |
| CVE-2025-23024 | GLPI 授权问题漏洞 — glpi | 7.5 | - | 2025-02-25 |
| CVE-2025-1361 | WordPress plugin IP2Location Country Blocker 授权问题漏洞 — IP2Location Country Blocker | 7.5 | High | 2025-02-22 |
| CVE-2025-25196 | OpenFGA 授权问题漏洞 — openfga | 8.1 | - | 2025-02-19 |
| CVE-2025-1007 | Eclipse Open VSX 安全漏洞 — OpenVSX | 4.3 | - | 2025-02-19 |
| CVE-2024-13692 | WordPress plugin Return Refund and Exchange For WooCommerce 授权问题漏洞 — Return Refund and Exchange For WooCommerce | 5.4 | Medium | 2025-02-14 |
| CVE-2025-1226 | yimioa 安全漏洞 — ywoa | 5.3 | Medium | 2025-02-12 |
| CVE-2024-13821 | WordPress plugin WP Booking Calendar 授权问题漏洞 — Booking Calendar | 5.3 | Medium | 2025-02-12 |
| CVE-2025-21400 | Microsoft SharePoint 授权问题漏洞 — Microsoft SharePoint Enterprise Server 2016 | 8.0 | High | 2025-02-11 |
| CVE-2025-24418 | Adobe Commerce 授权问题漏洞 — Adobe Commerce | 8.1 | High | 2025-02-11 |
| CVE-2025-1078 | AppHouseKitchen AlDente 安全漏洞 — AlDente Charge Limiter | 5.3 | Medium | 2025-02-06 |
| CVE-2024-57954 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 6.2 | Medium | 2025-02-06 |
| CVE-2025-20125 | Cisco ISE 授权问题漏洞 — Cisco Identity Services Engine Software | 9.1 | Critical | 2025-02-05 |
| CVE-2025-24376 | kubewarden-controller 安全漏洞 — kubewarden-controller | 6.5 | Medium | 2025-01-30 |
CWE-285（授权机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1213 条 CVE 漏洞。