CWE-285 授权机制不恰当 类弱点 1213 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-285 属于权限控制缺陷，指系统在访问资源或执行操作时未正确执行授权检查。攻击者常通过篡改请求参数或绕过前端限制，以非授权身份访问敏感数据或执行特权操作。开发者应实施严格的基于角色的访问控制，在服务器端对所有请求进行细粒度权限验证，确保仅允许合法用户执行相应操作，从而杜绝越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-3027 | WordPress Plugin Smart Slider 安全漏洞 — Smart Slider 3 | 6.4 | Medium | 2024-04-13 |
| CVE-2024-1289 | WordPress Plugin LearnPress 安全漏洞 — LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 6.5 | Medium | 2024-04-09 |
| CVE-2024-26193 | Microsoft Azure Migrate 安全漏洞 — Azure Migrate | 6.4 | Medium | 2024-04-09 |
| CVE-2024-3434 | CP Plus Wi-Fi Camera 安全漏洞 — Wi-Fi Camera | 5.4 | Medium | 2024-04-07 |
| CVE-2024-30260 | Undici 安全漏洞 — undici | 3.9 | Low | 2024-04-04 |
| CVE-2024-3139 | SourceCodester Computer Laboratory Management System 授权问题漏洞 — Computer Laboratory Management System | 5.4 | Medium | 2024-04-01 |
| CVE-2024-3013 | FLIR AX8 授权问题漏洞 — AX8 | 6.3 | Medium | 2024-03-28 |
| CVE-2024-0077 | NVIDIA Virtual GPU Manager 安全漏洞 — vGPU driver, Cloud Gaming driver | 7.8 | High | 2024-03-27 |
| CVE-2024-20333 | Cisco DNA Center 安全漏洞 — Cisco Digital Network Architecture Center (DNA Center) | 4.3 | Medium | 2024-03-27 |
| CVE-2024-29033 | OAuthenticator 安全漏洞 — oauthenticator | 7.5 | High | 2024-03-20 |
| CVE-2024-2641 | Ruijie Networks RG-NBS2009G-P 授权问题漏洞 — RG-NBS2009G-P | 5.3 | Medium | 2024-03-19 |
| CVE-2024-27930 | GLPI 安全漏洞 — glpi | 6.5 | Medium | 2024-03-18 |
| CVE-2024-27937 | GLPI 安全漏洞 — glpi | 6.5 | Medium | 2024-03-18 |
| CVE-2024-2557 | Food Waste Management System 授权问题漏洞 — Food Waste Management System | 5.3 | Medium | 2024-03-17 |
| CVE-2024-21761 | Fortinet FortiPortal 授权问题漏洞 — FortiPortal | 3.9 | Medium | 2024-03-12 |
| CVE-2024-2317 | BDTASK Hospital AutoManager 授权问题漏洞 — Hospital AutoManager | 3.8 | Low | 2024-03-08 |
| CVE-2024-27916 | Minder 安全漏洞 — minder | 7.1 | High | 2024-03-06 |
| CVE-2024-24900 | Dell Secure Connect Gateway 授权问题漏洞 — Secure Connect Gateway (SCG) Policy Manager | 5.8 | Medium | 2024-03-01 |
| CVE-2024-1043 | WordPress Plugin AMP for WP 安全漏洞 — AMP for WP – Accelerated Mobile Pages | 6.5 | Medium | 2024-02-20 |
| CVE-2024-21987 | NetApp SnapCenter 安全漏洞 — SnapCenter | 5.4 | Medium | 2024-02-16 |
| CVE-2024-21402 | Microsoft Outlook 安全漏洞 — Microsoft 365 Apps for Enterprise | 7.1 | High | 2024-02-13 |
| CVE-2024-23806 | HID iCLASS SE reader 授权问题漏洞 — HID iCLASS SE reader configuration cards | 5.3 | Medium | 2024-02-07 |
| CVE-2024-24936 | JetBrains TeamCity 安全漏洞 — TeamCity | 4.3 | Medium | 2024-02-06 |
| CVE-2024-23649 | Lemmy 授权问题漏洞 — lemmy | 7.5 | High | 2024-01-24 |
| CVE-2023-40683 | IBM OpenPages with Watson 权限许可和访问控制问题漏洞 — OpenPages with Watson | 8.8 | High | 2024-01-19 |
| CVE-2022-4962 | Apollo 授权问题漏洞 — Apollo | 4.3 | Medium | 2024-01-12 |
| CVE-2023-6878 | WordPress Plugin Slick Social Share Buttons 安全漏洞 — Slick Social Share Buttons | 8.8 | High | 2024-01-11 |
| CVE-2023-6496 | WordPress Plugin Manage Notification E-mails 安全漏洞 — Manage Notification E-mails | 5.3 | Medium | 2024-01-11 |
| CVE-2023-48252 | Bosch Nexo cordless nutrunner 安全漏洞 — Nexo cordless nutrunner NXA015S-36V (0608842001) | 8.8 | High | 2024-01-10 |
| CVE-2023-52139 | Misskey 授权问题漏洞 — misskey | 9.1 | Critical | 2023-12-29 |
CWE-285（授权机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1213 条 CVE 漏洞。