CWE-862 授权机制缺失 类弱点 8304 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-1390 | WordPress Plugin Paid Membership Subscriptions 安全漏洞 — Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | 4.3 | Medium | 2024-02-20 |
| CVE-2024-24741 | SAP Master Data Governance 安全漏洞 — SAP Master Data Governance Material | 4.3 | Medium | 2024-02-13 |
| CVE-2024-25643 | SAP Fiori 安全漏洞 — SAP Fiori app (My Overtime Requests) | 4.3 | Medium | 2024-02-13 |
| CVE-2024-24739 | SAP Bank Account Management 安全漏洞 — SAP BAM (Bank Account Management) | 6.3 | Medium | 2024-02-13 |
| CVE-2024-0596 | WordPress Plugin Awesome Support 安全漏洞 — Awesome Support – WordPress HelpDesk & Support Plugin | 5.3 | Medium | 2024-02-10 |
| CVE-2024-0595 | WordPress Plugin Awesome Support 安全漏洞 — Awesome Support – WordPress HelpDesk & Support Plugin | 4.3 | Medium | 2024-02-10 |
| CVE-2024-1122 | WordPress Plugin Eventin 安全漏洞 — Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | 5.3 | Medium | 2024-02-09 |
| CVE-2023-6840 | GitLab Enterprise Edition 安全漏洞 — GitLab | 6.7 | Medium | 2024-02-07 |
| CVE-2024-24822 | Pimcore 安全漏洞 — admin-ui-classic-bundle | 6.5 | Medium | 2024-02-07 |
| CVE-2024-1109 | WordPress Plugin Podlove Podcast Publisher 安全漏洞 — Podlove Podcast Publisher | 5.3 | Medium | 2024-02-07 |
| CVE-2024-1110 | WordPress Plugin Podlove Podcast Publisher 安全漏洞 — Podlove Podcast Publisher | 5.3 | Medium | 2024-02-07 |
| CVE-2024-1078 | WordPress Plugin Quiz Maker 安全漏洞 — Quiz Maker | 4.3 | Medium | 2024-02-07 |
| CVE-2024-1079 | WordPress Plugin Quiz Maker 安全漏洞 — Quiz Maker | 5.3 | Medium | 2024-02-07 |
| CVE-2023-6557 | WordPress plguin The Events Calendar 安全漏洞 — The Events Calendar | 5.3 | Medium | 2024-02-05 |
| CVE-2023-4637 | WordPress plguin WPvivid 安全漏洞 — WPvivid — Backup, Migration & Staging | 4.3 | Medium | 2024-02-05 |
| CVE-2024-1121 | WordPress plugin Advanced Forms for ACF 安全漏洞 — Advanced Forms for ACF | 5.3 | Medium | 2024-02-05 |
| CVE-2024-1072 | WordPress plugin Website Builder by SeedProd 安全漏洞 — Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode | 8.2 | High | 2024-02-05 |
| CVE-2023-6959 | WordPress plugin Getwid 安全漏洞 — Getwid – Gutenberg Blocks | 4.3 | Medium | 2024-02-05 |
| CVE-2024-1177 | WordPress plugin WP Club Manager 安全漏洞 — WP Club Manager – WordPress Sports Club Plugin | 5.3 | Medium | 2024-02-05 |
| CVE-2024-0835 | WordPress Plugin Royal Elementor Kit 安全漏洞 — Royal Elementor Kit | 4.3 | Medium | 2024-02-05 |
| CVE-2023-6700 | WordPress plugin Cookie Information | Free GDPR Consent Solution 安全漏洞 — Cookie Information | Free GDPR Consent Solution | 8.8 | High | 2024-02-05 |
| CVE-2024-0372 | WordPress plugin Views for WPForms 安全漏洞 — Views for WPForms – Display & Edit WPForms Entries on your site frontend | 4.3 | Medium | 2024-02-05 |
| CVE-2023-6985 | WordPress plugin 10Web AI Assistant 安全漏洞 — 10Web AI Assistant – AI content writing assistant | 6.5 | Medium | 2024-02-05 |
| CVE-2024-0791 | WordPress plugin WOLF 安全漏洞 — WOLF – WordPress Posts Bulk Editor and Manager Professional | 4.3 | Medium | 2024-02-05 |
| CVE-2024-0869 | WordPress plugin Instant Images 安全漏洞 — Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy | 8.8 | High | 2024-02-05 |
| CVE-2024-0797 | WordPress plugin Active Products Tables for WooCommerce. Professional products tables for WooCommerce store 安全漏洞 — Active Products Tables for WooCommerce. Use constructor to create tables | 4.3 | Medium | 2024-02-05 |
| CVE-2023-47148 | IBM Storage Protect Plus Server 安全漏洞 — Storage Protect Plus Server | 5.3 | Medium | 2024-02-02 |
| CVE-2024-1047 | WordPress plugin Orbit Fox by ThemeIsle 安全漏洞 — Menu Icons by ThemeIsle | 5.3 | Medium | 2024-02-02 |
| CVE-2024-1129 | WordPress Plugin NEX-Forms 安全漏洞 — NEX-Forms – Ultimate Forms Plugin for WordPress | 5.3 | Medium | 2024-02-01 |
| CVE-2024-1130 | WordPress Plugin NEX-Forms 安全漏洞 — NEX-Forms – Ultimate Forms Plugin for WordPress | 5.3 | Medium | 2024-02-01 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 8304 条 CVE 漏洞。