CWE-285 授权机制不恰当 类弱点 1213 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-285 属于权限控制缺陷，指系统在访问资源或执行操作时未正确执行授权检查。攻击者常通过篡改请求参数或绕过前端限制，以非授权身份访问敏感数据或执行特权操作。开发者应实施严格的基于角色的访问控制，在服务器端对所有请求进行细粒度权限验证，确保仅允许合法用户执行相应操作，从而杜绝越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-33712 | SAMSUNG Mobile devices 输入验证错误漏洞 — Camera | 3.3 | - | 2022-07-11 |
| CVE-2022-33702 | SAMSUNG Mobile devices Knoxguard 安全漏洞 — Samsung Mobile Devices | 6.2 | Medium | 2022-07-11 |
| CVE-2022-30757 | SAMSUNG Mobile devices isemtelephony 安全漏洞 — Samsung Mobile Devices | 4.0 | Medium | 2022-07-11 |
| CVE-2022-30670 | Adobe RoboHelp 授权问题漏洞 — RoboHelp | 8.8 | - | 2022-06-16 |
| CVE-2022-30746 | Samsung mobile 安全漏洞 — Smart Things | 7.5 | High | 2022-06-07 |
| CVE-2022-30730 | Samsung Pass 安全漏洞 — Samsung Pass | 4.6 | Medium | 2022-06-07 |
| CVE-2022-30722 | Samsung Account 安全漏洞 — Samsung Mobile Devices | 6.2 | Medium | 2022-06-07 |
| CVE-2022-30717 | Samsung mobile 安全漏洞 — Samsung Mobile Devices | 4.0 | Medium | 2022-06-07 |
| CVE-2022-2019 | Prison Management System 安全漏洞 — Prison Management System | 7.3 | High | 2022-06-07 |
| CVE-2022-31025 | Discourse 安全漏洞 — discourse | 2.6 | Low | 2022-06-03 |
| CVE-2022-29236 | BigBlueButton 授权问题漏洞 — bigbluebutton | 4.3 | Medium | 2022-06-01 |
| CVE-2022-29234 | BigBlueButton 授权问题漏洞 — bigbluebutton | 4.3 | Medium | 2022-06-01 |
| CVE-2022-29233 | BigBlueButton 授权问题漏洞 — bigbluebutton | 4.3 | Medium | 2022-06-01 |
| CVE-2022-26857 | Dell OpenManage Enterprise 安全漏洞 — OpenManage Enterprise | 9.0 | Critical | 2022-05-26 |
| CVE-2021-27772 | HCL Technologies HCL Sametime 授权问题漏洞 — Sametime | 7.1 | High | 2022-05-12 |
| CVE-2022-0027 | Palo Alto Networks Cortex XSOAR 安全漏洞 — Cortex XSOAR | 4.3 | Medium | 2022-05-11 |
| CVE-2021-43939 | Elcomplus SmartPPT 安全漏洞 — SmartPTT | 8.8 | High | 2022-04-28 |
| CVE-2022-0993 | WordPress plugin SiteGround Security 访问控制错误漏洞 — Security Optimizer – The All-In-One Protection Plugin | 8.1 | High | 2022-04-19 |
| CVE-2022-28776 | Samsung Galaxy Store 安全漏洞 — Galaxy Store | 5.9 | Medium | 2022-04-11 |
| CVE-2022-1224 | phpIPAM 安全漏洞 — phpipam/phpipam | 7.1 | - | 2022-04-04 |
| CVE-2022-0406 | calibre-web 安全漏洞 — janeczku/calibre-web | 5.4 | - | 2022-04-03 |
| CVE-2022-0860 | Cobbler 授权问题漏洞 — cobbler/cobbler | 9.1 | - | 2022-03-11 |
| CVE-2022-0821 | Orchard Core 安全漏洞 — orchardcms/orchardcore | 6.5 | - | 2022-03-10 |
| CVE-2022-0829 | Webmin 授权问题漏洞 — webmin/webmin | 8.3 | - | 2022-03-02 |
| CVE-2022-21196 | Airspan Mmp 安全漏洞 — MMP | 10.0 | Critical | 2022-02-18 |
| CVE-2022-0587 | Librenms 授权问题漏洞 — librenms/librenms | 8.1 | - | 2022-02-15 |
| CVE-2022-24002 | SAMSUNG Link Sharing 安全漏洞 — Link sharing | 4.0 | Medium | 2022-02-11 |
| CVE-2021-42000 | Ping Identity PingFederate 安全漏洞 — PingFederate | 5.3 | Medium | 2022-02-10 |
| CVE-2021-44204 | Acronis 多款产品安全漏洞 — Acronis Cyber Protect 15 | 7.8 | - | 2022-02-04 |
| CVE-2021-28500 | Arista Networks Arista EOS 安全漏洞 — Arista EOS | 9.1 | Critical | 2022-01-14 |
CWE-285（授权机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1213 条 CVE 漏洞。