CWE-639 通过用户控制密钥绕过授权机制 类弱点 2360 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-43350 | WordPress plugin Propovoice CRM 安全漏洞 — Propovoice CRM | 5.3 | Medium | 2024-08-18 |
| CVE-2024-42464 | upKeeper 安全漏洞 — upKeeper Manager | 7.5AI | High AI | 2024-08-16 |
| CVE-2024-42463 | upKeeper 安全漏洞 — upKeeper Manager | 7.5AI | High AI | 2024-08-16 |
| CVE-2023-7049 | WordPress plugin Custom Field For WP Job Manager 安全漏洞 — Custom Field For WP Job Manager | 4.3 | Medium | 2024-08-16 |
| CVE-2024-6534 | Directus 安全漏洞 — Directus | 4.3 | Medium | 2024-08-15 |
| CVE-2024-39642 | WordPress plugin LearnPress 安全漏洞 — LearnPress | 6.5 | Medium | 2024-08-13 |
| CVE-2024-3035 | GitLab 安全漏洞 — GitLab | 6.8 | Medium | 2024-08-08 |
| CVE-2024-6357 | OpenText ArcSight Intelligence 安全漏洞 — ArcSight Intelligence | 6.3 | Medium | 2024-08-06 |
| CVE-2024-38701 | WordPress plugin Academy LMS 安全漏洞 — Academy LMS | 4.3 | Medium | 2024-07-22 |
| CVE-2024-34457 | Apache StreamPark 安全漏洞 — Apache StreamPark | 6.5AI | Medium AI | 2024-07-22 |
| CVE-2024-5977 | WordPress plugin GiveWP 安全漏洞 — GiveWP – Donation Plugin and Fundraising Platform | 5.4 | Medium | 2024-07-19 |
| CVE-2024-5619 | PruvaSoft Informatics Apinizer Management Console 安全漏洞 — Apinizer Management Console | 9.6 | Critical | 2024-07-18 |
| CVE-2024-6410 | WordPress plugin ProfileGrid 安全漏洞 — ProfileGrid – User Profiles, Groups and Communities | 4.3 | Medium | 2024-07-10 |
| CVE-2024-39900 | OpenSearch Dashboards Reports 安全漏洞 — reporting | 5.4 | Medium | 2024-07-09 |
| CVE-2024-39901 | OpenSearch Dashboards Reports 安全漏洞 — observability | 4.2 | Medium | 2024-07-09 |
| CVE-2024-39897 | zot 安全漏洞 — zot | 4.3 | Medium | 2024-07-09 |
| CVE-2024-21759 | Fortinet FortiPorta 安全漏洞 — FortiPortal | 3.9 | Medium | 2024-07-09 |
| CVE-2023-3288 | Easy!Appointments 安全漏洞 — easyappointments | 8.5 | High | 2024-07-09 |
| CVE-2023-38055 | Easy!Appointments 安全漏洞 — easyappointments | 9.6 | Critical | 2024-07-09 |
| CVE-2023-38054 | Easy!Appointments 安全漏洞 — easyappointments | 9.9 | Critical | 2024-07-09 |
| CVE-2023-38053 | Easy!Appointments 安全漏洞 — easyappointments | 9.9 | Critical | 2024-07-09 |
| CVE-2023-38052 | Easy!Appointments 安全漏洞 — easyappointments | 9.9 | Critical | 2024-07-09 |
| CVE-2023-38051 | Easy!Appointments 安全漏洞 — easyappointments | 9.9 | Critical | 2024-07-09 |
| CVE-2023-38050 | Easy!Appointments 安全漏洞 — easyappointments | 9.1 | Critical | 2024-07-09 |
| CVE-2023-38049 | Easy!Appointments 安全漏洞 — easyappointments | 9.9 | Critical | 2024-07-09 |
| CVE-2023-38048 | Easy!Appointments 安全漏洞 — easyappointments | 9.9 | Critical | 2024-07-09 |
| CVE-2023-38047 | Easy!Appointments 安全漏洞 — easyappointments | 8.5 | High | 2024-07-09 |
| CVE-2023-3289 | Easy!Appointments 安全漏洞 — easyappointments | 7.7 | High | 2024-07-09 |
| CVE-2023-3290 | Easy!Appointments 安全漏洞 — easyappointments | 5.0 | Medium | 2024-07-09 |
| CVE-2023-3286 | Easy!Appointments 安全漏洞 — easyappointments | 7.7 | High | 2024-07-09 |
CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 2360 条 CVE 漏洞。