CWE-639 通过用户控制密钥绕过授权机制 类弱点 2041 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-46179 | LiuOS 安全漏洞 — LiuOS | 9.2 | Critical | 2022-12-28 |
| CVE-2022-4798 | memos 授权问题漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4799 | memos 授权问题漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4802 | memos 授权问题漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4803 | memos 访问控制错误漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4806 | memos 访问控制错误漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4811 | memos 授权问题漏洞 — usememos/memos | 8.3 | High | 2022-12-28 |
| CVE-2022-4812 | memos 安全漏洞 — usememos/memos | 4.3 | - | 2022-12-28 |
| CVE-2022-4686 | memos 授权问题漏洞 — usememos/memos | 9.1 | - | 2022-12-23 |
| CVE-2022-3794 | WordPress plugin Jeg Elementor Kit 安全漏洞 — Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | 5.4 | Medium | 2022-12-22 |
| CVE-2022-3805 | WordPress plugin Jeg Elementor Kit 安全漏洞 — Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | 8.6 | High | 2022-12-22 |
| CVE-2022-4505 | OpenEMR 访问控制错误漏洞 — openemr/openemr | 8.8 | High | 2022-12-15 |
| CVE-2022-2808 | Student Information System 安全漏洞 — Prens Student Information System | 8.8 | High | 2022-12-12 |
| CVE-2022-3995 | WordPress plugin TeraWallet 安全漏洞 — Wallet for WooCommerce | 4.3 | Medium | 2022-11-29 |
| CVE-2022-3589 | Miele appWash 安全漏洞 — appWash | 8.1 | High | 2022-11-21 |
| CVE-2022-3282 | WordPress Plugin Drag and Drop Multiple File Upload 安全漏洞 — Drag and Drop Multiple File Upload – Contact Form 7 | 8.1 | - | 2022-10-17 |
| CVE-2022-1613 | WordPress plugin Restricted Site Access 安全漏洞 — Restricted Site Access | 5.3 | - | 2022-09-26 |
| CVE-2022-1580 | WordPress plugin Site Offline 安全漏洞 — Site Offline Or Coming Soon Or Maintenance Mode | 4.3 | - | 2022-09-19 |
| CVE-2022-2913 | WordPress plugin Login No Captcha reCAPTCHA 安全漏洞 — Login No Captcha reCAPTCHA | 4.3 | - | 2022-09-16 |
| CVE-2022-2877 | WordPress plugin Titan Anti-spam & Security 安全漏洞 — Titan Anti-spam & Security | 5.3 | - | 2022-09-16 |
| CVE-2022-2080 | WordPress plugin Sensei LMS 安全漏洞 — Sensei LMS – Online Courses, Quizzes, & Learning | 5.4 | - | 2022-08-29 |
| CVE-2021-4142 | Red Hat Satellite 授权问题漏洞 — candlepin | 5.7 | - | 2022-08-24 |
| CVE-2022-2312 | WordPress plugin Student Result or Employee Database 跨站请求伪造漏洞 — Student Result or Employee Database | 5.4 | - | 2022-08-22 |
| CVE-2022-2198 | WordPress plugin WPQA Builder 安全漏洞 — WPQA Builder | 4.3 | - | 2022-08-22 |
| CVE-2022-2824 | OpenEMR 安全漏洞 — openemr/openemr | 8.8 | High | 2022-08-15 |
| CVE-2022-2535 | WordPress plugin SearchWP Live Ajax Search 安全漏洞 — SearchWP Live Ajax Search | 5.3 | - | 2022-08-15 |
| CVE-2022-2730 | OpenEMR 安全漏洞 — openemr/openemr | 8.2 | - | 2022-08-09 |
| CVE-2022-2367 | WordPress Plugin WSM Downloader 安全漏洞 — WSM Downloader | 7.5 | - | 2022-08-08 |
| CVE-2022-1600 | WordPress plugin YOP Poll 安全漏洞 — YOP Poll | 5.3 | - | 2022-08-01 |
| CVE-2022-33944 | MiCODUS MV720 GPS 安全漏洞 — MV720 | 6.5 | Medium | 2022-07-20 |
CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 2041 条 CVE 漏洞。