CWE-862 授权机制缺失 类弱点 8304 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-0907 | WordPress Plugin NEX-Forms 安全漏洞 — NEX-Forms – Ultimate Forms Plugin for WordPress | 5.3 | Medium | 2024-02-01 |
| CVE-2024-0836 | WordPress plugin WordPress Review & Structure Data Schema Plugin – Review Schema 安全漏洞 — Review Schema – Review & Structure Data Schema Plugin | 4.3 | Medium | 2024-01-31 |
| CVE-2023-22836 | Palantir Foundry 安全漏洞 — com.palantir.skywise:guardian | 3.5 | Low | 2024-01-29 |
| CVE-2023-1705 | Forcepoint One SmartEdge Agent 安全漏洞 — F|One SmartEdge Agent | 8.4 | High | 2024-01-29 |
| CVE-2023-5612 | GitLab 安全漏洞 — GitLab | 5.3 | Medium | 2024-01-26 |
| CVE-2024-21630 | Zulip 安全漏洞 — zulip | 4.3 | Medium | 2024-01-25 |
| CVE-2024-0617 | WordPress plugin Category Discount Woocommerce 安全漏洞 — Simple Discount Rules for Woocommerce | 5.3 | Medium | 2024-01-25 |
| CVE-2023-50944 | Apache Airflow 安全漏洞 — Apache Airflow | 6.5 | - | 2024-01-24 |
| CVE-2024-0679 | WordPress plugin ColorMag theme 安全漏洞 — ColorMag | 6.5 | Medium | 2024-01-20 |
| CVE-2022-42884 | WordPress plugin WIP Custom Login 安全漏洞 — WIP Custom Login | 5.4 | Medium | 2024-01-17 |
| CVE-2022-41790 | WordPress plugin WP Time Slots Booking Form 安全漏洞 — WP Time Slots Booking Form | 4.3 | Medium | 2024-01-17 |
| CVE-2022-41786 | WordPress plugin WP Job Portal 安全漏洞 — WP Job Portal – A Complete Job Board | 5.4 | Medium | 2024-01-17 |
| CVE-2022-41695 | WordPress plugin Traffic Manager 安全漏洞 — Traffic Manager | 5.4 | Medium | 2024-01-17 |
| CVE-2022-41619 | WordPress plugin Image Zoom 安全漏洞 — Image Zoom | 5.4 | Medium | 2024-01-17 |
| CVE-2022-40702 | WordPress plugin Advanced Local Pickup for WooCommerce 安全漏洞 — Advanced Local Pickup for WooCommerce | 5.4 | Medium | 2024-01-17 |
| CVE-2023-23882 | WordPress plugin Ultimate Addons for Beaver Builder 安全漏洞 — Ultimate Addons for Beaver Builder – Lite | 4.3 | Medium | 2024-01-17 |
| CVE-2023-23896 | WordPress plugin URL Shortener by MyThemeShop 安全漏洞 — URL Shortener by MyThemeShop | 5.4 | Medium | 2024-01-17 |
| CVE-2023-34379 | WordPress plugin Cart2Cart 安全漏洞 — Cart2Cart: Magento to WooCommerce Migration | 5.4 | Medium | 2024-01-17 |
| CVE-2022-40203 | WordPress plugin Advanced Dynamic Pricing for WooCommerce 安全漏洞 — Advanced Dynamic Pricing for WooCommerce | 6.3 | Medium | 2024-01-17 |
| CVE-2022-38141 | WordPress plugin Sales Report Email for WooCommerce 安全漏洞 — Sales Report Email for WooCommerce | 4.3 | Medium | 2024-01-17 |
| CVE-2022-36418 | WordPress plugin HREFLANG Tags Lite 安全漏洞 — HREFLANG Tags Lite | 6.5 | Medium | 2024-01-17 |
| CVE-2023-6955 | GitLab 安全漏洞 — GitLab | 6.6 | Medium | 2024-01-12 |
| CVE-2023-6554 | Tecnick TCExam 安全漏洞 — TCExam | 6.5AI | Medium AI | 2024-01-11 |
| CVE-2023-6598 | WordPress Plugin SpeedyCache 安全漏洞 — SpeedyCache – Cache, Optimization, Performance | 4.3 | Medium | 2024-01-11 |
| CVE-2023-6751 | WordPress Plugin Hostinger 安全漏洞 — Hostinger Tools | 7.3 | High | 2024-01-11 |
| CVE-2023-6638 | WordPress Plugin GTG Product Feed for Shopping 安全漏洞 — GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels | 6.5 | Medium | 2024-01-11 |
| CVE-2023-7019 | WordPress Plugin LightStart 安全漏洞 — LightStart – Maintenance Mode, Coming Soon and Landing Page Builder | 4.3 | Medium | 2024-01-11 |
| CVE-2023-6637 | WordPress Plugin CAOS | Host Google Analytics Locally 安全漏洞 — CAOS | Host Google Analytics Locally | 6.5 | Medium | 2024-01-11 |
| CVE-2023-6369 | WordPress Plugin Export WP Page to Static HTML/CSS 安全漏洞 — Export WordPress Pages to Static HTML & PDF — Static Site Export | 5.4 | Medium | 2024-01-11 |
| CVE-2023-6742 | WordPress Plugin Gallery Plugin for WordPress 安全漏洞 — Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | 4.3 | Medium | 2024-01-11 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 8304 条 CVE 漏洞。