目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-648 特权API的不正确使用 类漏洞列表 62

CWE-648 特权API的不正确使用 类弱点 62 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-648 属于特权 API 误用漏洞，指程序未遵循高权限函数的调用规范。攻击者常利用此缺陷，通过构造异常调用或绕过权限检查，诱导系统执行特权操作，从而获取未授权访问或提升权限。开发者应避免此类问题，需严格验证输入参数，确保调用上下文符合 API 的安全假设，并实施最小权限原则，防止非特权主体非法调用敏感接口。

MITRE CWE 官方描述
CWE：CWE-648 特权 API 使用不当 英文：产品未遵循需要额外特权的函数调用的 API 要求。这可能导致攻击者通过错误地调用该函数来获取特权。 当产品包含某些执行需要提升特权级别的操作的函数时，特权 API 的调用者必须谨慎：确保 API 所做的假设是有效的，例如参数的有效性；考虑到 API 调用在设计/实现中的已知弱点；从安全上下文调用该 API。如果 API 的调用者不遵循这些要求，则可能允许恶意用户或进程提升其特权、劫持进程或窃取敏感数据。例如，了解特权 API 在返回给调用者之前是否未放弃其特权，或者特权函数是否对调用者传递给它的数据、上下文或状态信息做出某些假设，这一点很重要。始终了解何时以及如何调用特权 API 至关重要，以确保其提升的特权级别不会被利用。
常见影响 (3)
Access Control Gain Privileges or Assume Identity
An attacker may be able to elevate privileges.
Confidentiality Read Application Data
An attacker may be able to obtain sensitive information.
Integrity, Confidentiality, Availability Execute Unauthorized Code or Commands
An attacker may be able to execute code.
缓解措施 (5)
Implementation Before calling privileged APIs, always ensure that the assumptions made by the privileged code hold true prior to making the call.
Architecture and Design Know architecture and implementation weaknesses of the privileged APIs and make sure to account for these weaknesses before calling the privileged APIs to ensure that they can be called safely.
Implementation If privileged APIs make certain assumptions about data, context or state validity that are passed by the caller, the calling code must ensure that these assumptions have been validated prior to making the call.
Implementation If privileged APIs do not shed their privilege prior to returning to the calling code, then calling code needs to shed these privileges immediately and safely right after the call to the privileged APIs. In particular, the calling code needs to ensure that a privileged thread of execution will never be returned to the user or made available to user-controlled processes.
Implementation Only call privileged APIs from safe, consistent and expected state.
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-6522 ExtremePacs Extreme XDS 安全漏洞 — Extreme XDS 7.2 High 2024-04-05
CVE-2023-4993 Utarit Information Technologies SoliPay Mobile App 安全漏洞 — SoliPay Mobile App 7.5 High 2024-02-15
CVE-2024-22042 Siemens Unicam FX 安全漏洞 — Unicam FX 7.8 High 2024-02-13
CVE-2023-6151 ESKOM Computer e-municipality module 安全漏洞 — e-municipality module 7.5 High 2023-11-28
CVE-2023-6150 ESKOM Computer e-municipality module 安全漏洞 — e-municipality module 7.5 High 2023-11-28
CVE-2023-4972 Yepas Digital Yepas 安全漏洞 — Digital Yepas 9.8 Critical 2023-09-14
CVE-2023-4009 MongoDB Ops Manager 安全漏洞 — MongoDB Ops Manager 7.2 High 2023-08-08
CVE-2023-20136 Cisco Secure Workload 安全漏洞 — Cisco Secure Workload 4.3 Medium 2023-06-28
CVE-2023-29507 XWiki Commons 安全漏洞 — xwiki-platform 9.1 Critical 2023-04-16
CVE-2023-28062 Dell PowerProtect Data Manager 安全漏洞 — PPDM Reporting (PowerProtect Data Manager) 8.8 High 2023-04-11
CVE-2022-20965 Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software 4.3 Medium 2023-01-18
CVE-2022-4805 memos 授权问题漏洞 — usememos/memos 8.1 - 2022-12-28
CVE-2022-4796 memos 安全漏洞 — usememos/memos 8.1 - 2022-12-28
CVE-2022-4687 memos 安全漏洞 — usememos/memos 8.1 - 2022-12-23
CVE-2022-20956 Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software 7.1 High 2022-11-03
CVE-2022-23720 Ping Identity Windows PingId 安全漏洞 — PingID Windows Login 7.5 High 2022-06-30
CVE-2022-2023 Trudesk 安全漏洞 — polonel/trudesk 8.8 - 2022-06-20
CVE-2022-24821 XWiki Platform 安全漏洞 — xwiki-platform 6.8 Medium 2022-04-08
CVE-2022-24073 Naver Whale Browser 安全漏洞 — NAVER Whale browser 6.1 - 2022-03-17
CVE-2022-24071 Naver Whale browser 安全漏洞 — NAVER Whale browser 4.3 - 2022-01-28
CVE-2020-7927 Mongodb Ops Manager 授权问题漏洞 — MongoDB Ops Manager 8.1 High 2020-11-23
CVE-2020-5291 Bubblewrap 安全漏洞 — bubblewrap 7.2 High 2020-03-31
CVE-2019-14812 Artifex Software Ghostscript 安全漏洞 — ghostscript 7.8 - 2019-11-27
CVE-2019-10216 Artifex Software Ghostscript 安全漏洞 — ghostscript 7.1 - 2019-11-27
CVE-2019-14869 Artifex Software Ghostscript 安全漏洞 — ghostscript 8.8 - 2019-11-15
CVE-2019-14813 Artifex Software Ghostscript 权限许可和访问控制问题漏洞 — ghostscript 8.8 - 2019-09-06
CVE-2019-14817 Artifex Software Ghostscript 权限许可和访问控制问题漏洞 — ghostscript 7.8 - 2019-09-03
CVE-2019-14811 Artifex Software Ghostscript 权限许可和访问控制问题漏洞 — ghostscript 7.8 - 2019-09-03
CVE-2019-1010178 MODX Fred 访问控制错误漏洞 — MODX Revolution 9.8 - 2019-07-24
CVE-2019-3839 Artifex Software Ghostscript 权限许可和访问控制问题漏洞 — ghostscript 7.1 - 2019-05-16

CWE-648（特权API的不正确使用） 是常见的弱点类别，本平台收录该类弱点关联的 62 条 CVE 漏洞。