CWE-841 行为工作流的不恰当实施 类弱点 67 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-841 属于业务流程执行不当漏洞，指系统未强制要求用户按既定顺序完成多步操作。攻击者常通过跳过中间步骤或颠倒操作顺序，篡改业务逻辑或使系统进入无效状态，进而可能引发数据泄露或权限提升。开发者应实施严格的会话状态管理，在服务器端验证每一步骤的完整性与顺序，确保关键业务逻辑仅在满足所有前置条件后才得以执行，从而杜绝此类风险。
def dispatchCommand(command, user, args): if command == 'Login': loginUser(args) return # user has requested a file if command == 'Retrieve_file': if authenticated(user) and ownsFile(user,args): sendFile(args) return if command == 'List_files': listFiles(args) return ...def dispatchCommand(command, user, args): ... if command == 'List_files': if authenticated(user) and ownsDirectory(user,args): listFiles(args) return ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-0410 | GitLab 访问控制错误漏洞 — GitLab | 7.7 | High | 2024-02-21 |
| CVE-2023-5921 | DECE Software Geodi 安全漏洞 — Geodi | 7.1 | High | 2023-11-22 |
| CVE-2023-4181 | Hospital Management System 安全漏洞 — Free Hospital Management System for Small Practices | 5.4 | Medium | 2023-08-06 |
| CVE-2023-1383 | Amazon Fire TV Stick 安全漏洞 — Fire TV Stick 3rd gen | 5.4 | Medium | 2023-05-03 |
| CVE-2022-2102 | Secheron SEPCOS Control and Protection Relay 代码问题漏洞 — SEPCOS Control and Protection Relay firmware package | 9.4 | Critical | 2022-06-24 |
| CVE-2022-2105 | Secheron SEPCOS Control and Protection Relay 安全漏洞 — SEPCOS Control and Protection Relay firmware package | 9.4 | Critical | 2022-06-24 |
| CVE-2022-1667 | Secheron SEPCOS Control and Protection Relay 安全漏洞 — SEPCOS Control and Protection Relay firmware package | 7.5 | High | 2022-06-24 |
CWE-841（行为工作流的不恰当实施） 是常见的弱点类别，本平台收录该类弱点关联的 67 条 CVE 漏洞。