目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-648 特权API的不正确使用 类漏洞列表 61

CWE-648 特权API的不正确使用 类弱点 61 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-648 属于特权 API 误用漏洞，指程序未遵循高权限函数的调用规范。攻击者常利用此缺陷，通过构造异常调用或绕过权限检查，诱导系统执行特权操作，从而获取未授权访问或提升权限。开发者应避免此类问题，需严格验证输入参数，确保调用上下文符合 API 的安全假设，并实施最小权限原则，防止非特权主体非法调用敏感接口。

MITRE CWE 官方描述
CWE：CWE-648 特权 API 使用不当 英文：产品未遵循需要额外特权的函数调用的 API 要求。这可能导致攻击者通过错误地调用该函数来获取特权。 当产品包含某些执行需要提升特权级别的操作的函数时，特权 API 的调用者必须谨慎：确保 API 所做的假设是有效的，例如参数的有效性；考虑到 API 调用在设计/实现中的已知弱点；从安全上下文调用该 API。如果 API 的调用者不遵循这些要求，则可能允许恶意用户或进程提升其特权、劫持进程或窃取敏感数据。例如，了解特权 API 在返回给调用者之前是否未放弃其特权，或者特权函数是否对调用者传递给它的数据、上下文或状态信息做出某些假设，这一点很重要。始终了解何时以及如何调用特权 API 至关重要，以确保其提升的特权级别不会被利用。
常见影响 (3)
Access Control Gain Privileges or Assume Identity
An attacker may be able to elevate privileges.
Confidentiality Read Application Data
An attacker may be able to obtain sensitive information.
Integrity, Confidentiality, Availability Execute Unauthorized Code or Commands
An attacker may be able to execute code.
缓解措施 (5)
Implementation Before calling privileged APIs, always ensure that the assumptions made by the privileged code hold true prior to making the call.
Architecture and Design Know architecture and implementation weaknesses of the privileged APIs and make sure to account for these weaknesses before calling the privileged APIs to ensure that they can be called safely.
Implementation If privileged APIs make certain assumptions about data, context or state validity that are passed by the caller, the calling code must ensure that these assumptions have been validated prior to making the call.
Implementation If privileged APIs do not shed their privilege prior to returning to the calling code, then calling code needs to shed these privileges immediately and safely right after the call to the privileged APIs. In particular, the calling code needs to ensure that a privileged thread of execution will never be returned to the user or made available to user-controlled processes.
Implementation Only call privileged APIs from safe, consistent and expected state.
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-63727 Anchore Enterprise 权限许可和访问控制问题漏洞 — Anchore Enterprise 8.8 High 2026-07-28
CVE-2026-54424 Unity parsec 权限许可和访问控制问题漏洞 — Parsec 8.4 High 2026-07-04
CVE-2026-11877 OpenText Access Manager 权限许可和访问控制问题漏洞 — Access Manager - - 2026-06-24
CVE-2026-41225 F5 BIG-IP 安全漏洞 — BIG-IP 9.1 Critical 2026-05-13
CVE-2026-41386 OpenClaw 安全漏洞 — OpenClaw 9.1 Critical 2026-04-28
CVE-2026-41329 OpenClaw 安全漏洞 — OpenClaw 9.9 Critical 2026-04-20
CVE-2026-35669 OpenClaw 安全漏洞 — OpenClaw 8.8 High 2026-04-10
CVE-2026-35663 OpenClaw 安全漏洞 — OpenClaw 8.8 High 2026-04-10
CVE-2026-35645 OpenClaw 安全漏洞 — OpenClaw 8.1 High 2026-04-09
CVE-2026-35639 OpenClaw 安全漏洞 — OpenClaw 8.8 High 2026-04-09
CVE-2026-35625 OpenClaw 安全漏洞 — OpenClaw 7.8 High 2026-04-09
CVE-2026-20122 Cisco Catalyst SD-WAN Manager 安全漏洞 — Cisco Catalyst SD-WAN Manager 5.4 Medium 2026-02-25
CVE-2026-20126 Cisco Catalyst SD-WAN Manager 安全漏洞 — Cisco Catalyst SD-WAN Manager 8.8 High 2026-02-25
CVE-2026-22922 Apache Airflow 安全漏洞 — Apache Airflow 4.3AI Medium AI 2026-02-09
CVE-2025-1161 NomySoft Nomysem 安全漏洞 — Nomysem 7.1 High 2025-12-10
CVE-2024-32008 Siemens Spectrum Power 安全漏洞 — Spectrum Power 4 7.8 High 2025-11-11
CVE-2025-54768 XORUX LPAR2RRD 安全漏洞 — LPAR2RRD 4.3AI Medium AI 2025-07-28
CVE-2025-54767 XORUX LPAR2RRD 安全漏洞 — LPAR2RRD 6.5AI Medium AI 2025-07-28
CVE-2025-54765 XORUX XorMon-NG 安全漏洞 — XorMon-NG 8.8AI High AI 2025-07-28
CVE-2025-54766 XORUX XorMon-NG 安全漏洞 — XorMon-NG 6.5AI Medium AI 2025-07-28
CVE-2025-5997 Beamsec PhishPro 安全漏洞 — PhishPro 8.8 High 2025-07-28
CVE-2025-7344 Digiwin EAI 安全漏洞 — EAI 8.8 High 2025-07-21
CVE-2025-23375 Dell PowerProtect Data Manager Reporting 安全漏洞 — PowerProtect Data Manager 7.8 High 2025-04-28
CVE-2022-26323 OpenText多款产品 安全漏洞 — Operations Bridge Manager 8.8AI High AI 2025-04-17
CVE-2025-2311 Nebula Informatics SecHard 安全漏洞 — SecHard 9.0 Critical 2025-03-20
CVE-2024-53007 Bentley Systems ProjectWise Integration Server 安全漏洞 — ProjectWise Integration Server 6.4 Medium 2025-01-31
CVE-2024-8785 Progress Software WhatsUp Gold 安全漏洞 — WhatsUp Gold 9.8 Critical 2024-12-02
CVE-2024-11068 D-Link DSL6740C 安全漏洞 — DSL6740C 9.8 Critical 2024-11-11
CVE-2024-46978 XWiki Platform 安全漏洞 — xwiki-platform 6.5 Medium 2024-09-18
CVE-2023-6522 ExtremePacs Extreme XDS 安全漏洞 — Extreme XDS 7.2 High 2024-04-05

CWE-648（特权API的不正确使用） 是常见的弱点类别，本平台收录该类弱点关联的 61 条 CVE 漏洞。