CWE-285 授权机制不恰当 类弱点 1213 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-285 属于权限控制缺陷，指系统在访问资源或执行操作时未正确执行授权检查。攻击者常通过篡改请求参数或绕过前端限制，以非授权身份访问敏感数据或执行特权操作。开发者应实施严格的基于角色的访问控制，在服务器端对所有请求进行细粒度权限验证，确保仅允许合法用户执行相应操作，从而杜绝越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-28506 | Arista Networks Arista EOS安全漏洞 — EOS | 9.1 | Critical | 2022-01-14 |
| CVE-2021-28501 | Arista Networks Arista EOS 安全漏洞 — Terminattr | 9.1 | Critical | 2022-01-14 |
| CVE-2022-22288 | SAMSUNG Galaxy Store 安全漏洞 — Galaxy Store | 7.5 | High | 2022-01-07 |
| CVE-2022-22269 | Samsung SMR安全漏洞 — Samsung Mobile Devices | 4.0 | Medium | 2022-01-07 |
| CVE-2022-22267 | Samsung SMR 安全漏洞 — Samsung Mobile Devices | 4.0 | Medium | 2022-01-07 |
| CVE-2022-22272 | Samsung SMR 安全漏洞 — Samsung Mobile Devices | 4.0 | Medium | 2022-01-07 |
| CVE-2022-22268 | Samsung SMR安全漏洞 — Samsung Mobile Devices | 6.1 | Medium | 2022-01-07 |
| CVE-2020-9061 | Silicon Labs Z-Wave Chipsets 授权问题漏洞 — ZST10 | 6.5 | - | 2022-01-07 |
| CVE-2021-3837 | Openwhyd 安全漏洞 — openwhyd/openwhyd | 6.1 | - | 2022-01-03 |
| CVE-2021-43847 | HumHub 授权问题漏洞 — humhub | 6.5 | Medium | 2021-12-20 |
| CVE-2021-25521 | Samsung Internet 跨站脚本漏洞 — Samsung Internet | 4.0 | Medium | 2021-12-08 |
| CVE-2021-42126 | Ivanti Avalanche 安全漏洞 — Ivanti Avalanche | 8.8 | - | 2021-12-07 |
| CVE-2021-36311 | DELL EMC NetWorker 安全漏洞 — NetWorker | 6.0 | Medium | 2021-11-23 |
| CVE-2021-42338 | Radiant Tech 4Mosan Gcb Doctor 授权问题漏洞 — GCB Doctor | 9.8 | Critical | 2021-11-19 |
| CVE-2021-42337 | Aifu 艾富资讯出纳帐务管理系统 安全漏洞 — CASH | 4.3 | Medium | 2021-11-16 |
| CVE-2021-25507 | SAMSUNG Flow 安全漏洞 — Samsung Flow | 5.7 | Medium | 2021-11-05 |
| CVE-2021-25973 | Publify 授权问题漏洞 — publify_core | 6.5 | Medium | 2021-11-02 |
| CVE-2021-39341 | WordPress plugin Google Maps Easy安全漏洞 — OptinMonster | 8.2 | High | 2021-11-01 |
| CVE-2021-41313 | Atlassian Jira 安全漏洞 — Jira Server | 4.3 | - | 2021-11-01 |
| CVE-2021-41308 | Atlassian Jira 安全漏洞 — Jira Server | 6.5 | - | 2021-10-26 |
| CVE-2021-31384 | Juniper Networks Junos OS 安全漏洞 — Junos OS | 7.2 | High | 2021-10-19 |
| CVE-2021-38486 | IR615 Router 授权问题漏洞 — IR615 Router | 8.0 | High | 2021-10-19 |
| CVE-2021-42336 | Easytest 安全漏洞 — Easytest | 4.3 | Medium | 2021-10-15 |
| CVE-2021-42332 | ShinHer StudyOnline System 安全漏洞 — ShinHer StudyOnline System | 4.3 | Medium | 2021-10-15 |
| CVE-2021-42331 | ShinHer StudyOnline System 授权问题漏洞 — ShinHer StudyOnline System | 5.4 | Medium | 2021-10-15 |
| CVE-2021-42330 | ShinHer StudyOnline System 安全漏洞 — ShinHer StudyOnline System | 8.8 | High | 2021-10-15 |
| CVE-2021-41137 | MinIO 安全漏洞 — minio | 8.8 | High | 2021-10-13 |
| CVE-2021-33723 | Siemens SINEC NMS 安全漏洞 — SINEC NMS | 6.5 | - | 2021-10-12 |
| CVE-2021-39317 | WordPress 代码问题漏洞 — Access Demo Importer | 8.8 | High | 2021-10-11 |
| CVE-2021-41976 | Tad Uploader 访问控制错误漏洞 — Uploader | 5.3 | Medium | 2021-10-08 |
CWE-285（授权机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1213 条 CVE 漏洞。