CWE-639 通过用户控制密钥绕过授权机制 类弱点 2041 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-1744 | Ariva Computer Accord ORS 信息泄露漏洞 — Accord ORS | 7.5 | - | 2024-09-06 |
| CVE-2024-8292 | WordPress plugin WP-Recall 安全漏洞 — WP-Recall – Registration, Profile, Commerce & More | 9.8 | Critical | 2024-09-06 |
| CVE-2024-8123 | WordPress plugin WP Extended 安全漏洞 — The Ultimate WordPress Toolkit – WP Extended | 5.4 | Medium | 2024-09-04 |
| CVE-2024-43916 | WordPress plugin Zephyr Project Manager 安全漏洞 — Zephyr Project Manager | 4.3 | Medium | 2024-08-26 |
| CVE-2024-8158 | lib9p 安全漏洞 — 9front | 6.8AI | Medium AI | 2024-08-25 |
| CVE-2024-7848 | WordPress plugin User Private Files 安全漏洞 — File Sharing & Download Manager – User Private Files | 4.3 | Medium | 2024-08-22 |
| CVE-2024-43239 | WordPress plugin Masteriyo - LMS 安全漏洞 — Masteriyo - LMS | 4.3 | Medium | 2024-08-18 |
| CVE-2024-43266 | WordPress plugin WP Job Portal 安全漏洞 — WP Job Portal | 5.4 | Medium | 2024-08-18 |
| CVE-2024-43288 | WordPress plugin wpForo Forum 安全漏洞 — wpForo Forum | 4.3 | Medium | 2024-08-18 |
| CVE-2024-43315 | WordPress plugin Stripe Payments For WooCommerce by Checkout 安全漏洞 — Stripe Payments For WooCommerce by Checkout | 7.5 | High | 2024-08-18 |
| CVE-2024-43322 | WordPress plugin Zephyr Project Manager 安全漏洞 — Zephyr Project Manager | 5.4 | Medium | 2024-08-18 |
| CVE-2024-43350 | WordPress plugin Propovoice CRM 安全漏洞 — Propovoice CRM | 5.3 | Medium | 2024-08-18 |
| CVE-2024-42464 | upKeeper 安全漏洞 — upKeeper Manager | 7.5AI | High AI | 2024-08-16 |
| CVE-2024-42463 | upKeeper 安全漏洞 — upKeeper Manager | 7.5AI | High AI | 2024-08-16 |
| CVE-2023-7049 | WordPress plugin Custom Field For WP Job Manager 安全漏洞 — Custom Field For WP Job Manager | 4.3 | Medium | 2024-08-16 |
| CVE-2024-6534 | Directus 安全漏洞 — Directus | 4.3 | Medium | 2024-08-15 |
| CVE-2024-39642 | WordPress plugin LearnPress 安全漏洞 — LearnPress | 6.5 | Medium | 2024-08-13 |
| CVE-2024-3035 | GitLab 安全漏洞 — GitLab | 6.8 | Medium | 2024-08-08 |
| CVE-2024-6357 | OpenText ArcSight Intelligence 安全漏洞 — ArcSight Intelligence | 6.3 | Medium | 2024-08-06 |
| CVE-2024-38701 | WordPress plugin Academy LMS 安全漏洞 — Academy LMS | 4.3 | Medium | 2024-07-22 |
| CVE-2024-34457 | Apache StreamPark 安全漏洞 — Apache StreamPark | 6.5AI | Medium AI | 2024-07-22 |
| CVE-2024-5977 | WordPress plugin GiveWP 安全漏洞 — GiveWP – Donation Plugin and Fundraising Platform | 5.4 | Medium | 2024-07-19 |
| CVE-2024-5619 | PruvaSoft Informatics Apinizer Management Console 安全漏洞 — Apinizer Management Console | 9.6 | Critical | 2024-07-18 |
| CVE-2024-6410 | WordPress plugin ProfileGrid 安全漏洞 — ProfileGrid – User Profiles, Groups and Communities | 4.3 | Medium | 2024-07-10 |
| CVE-2024-39900 | OpenSearch Dashboards Reports 安全漏洞 — reporting | 5.4 | Medium | 2024-07-09 |
| CVE-2024-39901 | OpenSearch Dashboards Reports 安全漏洞 — observability | 4.2 | Medium | 2024-07-09 |
| CVE-2024-39897 | zot 安全漏洞 — zot | 4.3 | Medium | 2024-07-09 |
| CVE-2024-21759 | Fortinet FortiPorta 安全漏洞 — FortiPortal | 3.9 | Medium | 2024-07-09 |
| CVE-2023-3288 | Easy!Appointments 安全漏洞 — easyappointments | 8.5 | High | 2024-07-09 |
| CVE-2023-38055 | Easy!Appointments 安全漏洞 — easyappointments | 9.6 | Critical | 2024-07-09 |
CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 2041 条 CVE 漏洞。