CWE-669 在范围间的资源转移不正确 类弱点 70 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-669属于资源跨域转移不当漏洞，指产品在将资源或行为从一个安全域转移至另一个域时，未正确实施控制，导致意外获得对该资源的控制权。攻击者通常利用此缺陷，通过操纵跨域数据或调用，绕过安全边界以执行特权操作或注入恶意逻辑。开发者应避免在域间传递未经验证的数据，实施严格的访问控制与输入校验，并确保跨域交互时遵循最小权限原则，以阻断非法控制路径。
<form action="FileUploadServlet" method="post" enctype="multipart/form-data"> Choose a file to upload: <input type="file" name="filename"/> <br/> <input type="submit" name="submit" value="Submit"/> </form>public class FileUploadServlet extends HttpServlet { ... protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html"); PrintWriter out = response.getWriter(); String contentType = request.getContentType(); // the starting position of the boundary header int ind = contentType.indexOf("boundary="); String boundary = contentType.substring(ind+9); String pLine = new String(); String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value // verify that content type is multipart form data i//assume the password is already encrypted, avoiding CWE-312 function authenticate($username,$password){ include("http://external.example.com/dbInfo.php"); //dbInfo.php makes $dbhost, $dbuser, $dbpass, $dbname available mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql'); mysql_select_db($dbname); $query = 'Select * from users where username='.$username.' And password='.$password; $result = mysql_query($query); if(mysql_numrows($result) == 1){ mysql_close(); return true; } else{ mysql_close(); return false; } }CWE-669（在范围间的资源转移不正确） 是常见的弱点类别，本平台收录该类弱点关联的 70 条 CVE 漏洞。