CWE-862 授权机制缺失 类弱点 8304 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-6855 | WordPress Plugin Paid Memberships Pro 安全漏洞 — Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions | 5.3 | Medium | 2024-01-11 |
| CVE-2023-6883 | WordPress Plugin Easy Social Feed 安全漏洞 — Easy Social Feed – Social Photos Gallery and Post Feed for WordPress | 4.3 | Medium | 2024-01-11 |
| CVE-2023-6158 | WordPress plugin EventON 安全漏洞 — EventON – Events Calendar | 6.5 | Medium | 2024-01-10 |
| CVE-2023-48247 | Bosch Nexo cordless nutrunner 安全漏洞 — Nexo cordless nutrunner NXA015S-36V (0608842001) | 5.3 | Medium | 2024-01-10 |
| CVE-2023-48245 | Bosch Nexo cordless nutrunner 安全漏洞 — Nexo cordless nutrunner NXA015S-36V (0608842001) | 6.5 | Medium | 2024-01-10 |
| CVE-2022-36352 | WordPress Plugin ProfileGrid 安全漏洞 — ProfileGrid – User Profiles, Memberships, Groups and Communities | 6.3 | Medium | 2024-01-08 |
| CVE-2022-34344 | WordPress Plugin Wholesale Suite 安全漏洞 — Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More | 5.4 | Medium | 2024-01-08 |
| CVE-2023-6798 | WordPress plugin RSS Aggregator by Feedzy 安全漏洞 — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | 5.4 | Medium | 2024-01-06 |
| CVE-2024-0201 | WordPress Plugin Product Expiry for WooCommerce 安全漏洞 — Product Expiry for WooCommerce | 5.4 | Medium | 2024-01-03 |
| CVE-2023-7068 | WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels 安全漏洞 — WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | 4.3 | Medium | 2024-01-03 |
| CVE-2023-6600 | WordPress Plugin OMGF 安全漏洞 — OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 8.6 | High | 2024-01-03 |
| CVE-2023-4468 | Poly Trio 安全漏洞 — Trio 8500 | 4.3 | Medium | 2023-12-29 |
| CVE-2023-22676 | WordPress Plugin Advanced Custom Fields 安全漏洞 — Anders Thorborg | 3.1 | Low | 2023-12-29 |
| CVE-2023-51650 | Hertzbeat 安全漏洞 — hertzbeat | 7.5 | High | 2023-12-22 |
| CVE-2023-22674 | WordPress plugin Dashicons + Custom Post Types 安全漏洞 — Dashicons + Custom Post Types | 5.4 | Medium | 2023-12-21 |
| CVE-2023-25715 | WordPress plugin GamiPress 安全漏洞 — GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress | 5.4 | Medium | 2023-12-19 |
| CVE-2023-46212 | WordPress Plugin WP EXtra 安全漏洞 — WP EXtra | 6.3 | Medium | 2023-12-18 |
| CVE-2023-47754 | WordPress Plugin Delete Duplicate Posts 安全漏洞 — Delete Duplicate Posts | 4.3 | Medium | 2023-12-18 |
| CVE-2023-48751 | WordPress Plugin Participants Database 安全漏洞 — Participants Database | 4.3 | Medium | 2023-12-18 |
| CVE-2023-5056 | Skupper skupper-operator 安全漏洞 — Service Interconnect 1 for RHEL 9 | 6.8 | Medium | 2023-12-18 |
| CVE-2023-5061 | GitLab 安全漏洞 — GitLab | 4.3 | Medium | 2023-12-15 |
| CVE-2023-48375 | SmartStar Software CWS 安全漏洞 — CWS Web-Base | 8.8 | High | 2023-12-15 |
| CVE-2023-48676 | Acronis Cyber Protect 安全漏洞 — Acronis Cyber Protect Cloud Agent | 9.1AI | Critical AI | 2023-12-14 |
| CVE-2023-6394 | Quarkus 安全漏洞 — Red Hat build of Quarkus 2.13.9 | 7.4 | High | 2023-12-09 |
| CVE-2023-39167 | EnBw SENEC Legacy Storage Box 访问控制错误漏洞 — Storage Box V1 | 7.5 | High | 2023-12-07 |
| CVE-2023-5710 | WordPress plugin System Dashboard 安全漏洞 — System Dashboard | 4.3 | Medium | 2023-12-07 |
| CVE-2023-5712 | WordPress plugin System Dashboard 安全漏洞 — System Dashboard | 4.3 | Medium | 2023-12-07 |
| CVE-2023-5713 | WordPress plugin System Dashboard 安全漏洞 — System Dashboard | 4.3 | Medium | 2023-12-07 |
| CVE-2023-5714 | WordPress plugin System Dashboard 安全漏洞 — System Dashboard | 4.3 | Medium | 2023-12-07 |
| CVE-2023-5711 | WordPress plugin System Dashboard 安全漏洞 — System Dashboard | 4.3 | Medium | 2023-12-07 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 8304 条 CVE 漏洞。