CWE-639 通过用户控制密钥绕过授权机制 类弱点 2041 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-24840 | WordPress 插件安全漏洞 — Squaretype | 5.3 | - | 2021-11-08 |
| CVE-2021-39225 | Nextcloud 安全漏洞 — security-advisories | 8.1 | High | 2021-10-25 |
| CVE-2021-40355 | Teamcenter 代码问题漏洞 — Teamcenter V12.4 | 8.8 | - | 2021-09-14 |
| CVE-2021-37184 | Siemens Industrial Edge Management 授权问题漏洞 — Industrial Edge Management | 9.1 | - | 2021-09-14 |
| CVE-2021-37628 | Nextcloud 信息泄露漏洞 — security-advisories | 7.5 | High | 2021-09-07 |
| CVE-2021-37630 | Nextcloud 安全漏洞 — security-advisories | 6.5 | Medium | 2021-09-07 |
| CVE-2021-37631 | Nextcloud安全漏洞 — security-advisories | 6.5 | Medium | 2021-09-07 |
| CVE-2021-24562 | WordPress 插件跨站脚本漏洞 — LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress | 7.5 | - | 2021-08-23 |
| CVE-2021-36801 | Akaunting 安全漏洞 — Akaunting | 8.1 | High | 2021-08-04 |
| CVE-2021-24473 | WordPress 插件访问控制错误漏洞 — User Profile Picture | 5.4 | - | 2021-08-02 |
| CVE-2021-32744 | Collabora Online 安全漏洞 — online | 9.8 | Critical | 2021-07-21 |
| CVE-2021-24374 | WordPress plugin Jetpack Carousel module of the JetPack 安全漏洞 — Jetpack – WP Security, Backup, Speed, & Growth | 5.3 | - | 2021-06-21 |
| CVE-2021-32654 | Nextcloud 安全漏洞 — security-advisories | 8.1 | High | 2021-06-01 |
| CVE-2021-21324 | GLPI 安全漏洞 — glpi | 6.8 | Medium | 2021-03-08 |
| CVE-2020-8297 | Nextcloud Deck 安全漏洞 — Nextcloud Deck | 4.3 | - | 2021-02-23 |
| CVE-2021-21022 | Adobe Magento 授权问题漏洞 — Magento Commerce | 5.3 | - | 2021-02-11 |
| CVE-2021-21012 | Adobe Bridge 缓冲区错误漏洞 — Magento Commerce | 5.3 | - | 2021-01-13 |
| CVE-2020-26068 | Cisco RoomOS Software 权限许可和访问控制问题漏洞 — Cisco TelePresence Endpoint Software (TC/CE) | 5.5 | Medium | 2020-11-18 |
| CVE-2020-8235 | Nextcloud 安全漏洞 — Nextcloud Deck app | 4.3 | - | 2020-10-05 |
| CVE-2020-16240 | GE APM Classic 安全漏洞 — GE Digital APM Classic | 5.3 | - | 2020-09-23 |
| CVE-2020-8154 | Nextcloud Server 安全漏洞 — Nextcloud Server | 6.5 | - | 2020-05-12 |
| CVE-2019-15581 | GitLab 安全漏洞 — GitLab EE | 5.3 | - | 2020-01-28 |
| CVE-2019-5466 | GitLab 信息泄露漏洞 — GitLab CE/EE | 4.3 | - | 2020-01-28 |
| CVE-2019-15582 | GitLab 信息泄露漏洞 — GitLab EE | 5.3 | - | 2020-01-28 |
| CVE-2019-5469 | GitLab 安全漏洞 — GitLab | 6.5 | - | 2019-12-18 |
| CVE-2017-3183 | Sage XRT Treasury SQL注入漏洞 — XRT Treasury | 8.8 | - | 2018-07-24 |
| CVE-2017-0936 | Nextcloud Server 安全漏洞 — Nextcloud Server | 6.5 | - | 2018-03-28 |
| CVE-2017-0920 | GitLab Community Edition和Enterprise Edition Projects::MergeRequests::CreationsController安全漏洞 — GitLab Community and Enterprise Editions | 4.3 | - | 2018-03-22 |
| CVE-2017-0922 | Gitlab Enterprise Edition GitLab Projects::BoardsController组件安全漏洞 — GitLab Community and Enterprise Editions | 7.5 | - | 2018-03-21 |
| CVE-2017-0882 | GitLab 安全漏洞 — GitLab Community Edition and GitLab Enterprise Edition 8.7.0 through 8.15.7, 8.16.0 through 8.16.7, 8.17.0 through 8.17.3 | 8.3 | - | 2017-03-28 |
CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 2041 条 CVE 漏洞。