CWE-862 授权机制缺失 类弱点 8301 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-5132 | WordPress Plugin Soisy Pagamento Rateale 安全漏洞 — Soisy Pagamento Rateale | 7.5 | High | 2023-10-21 |
| CVE-2022-3622 | WordPress plugin Blog2Social 安全漏洞 — Blog2Social: Social Media Auto Post & Scheduler | 4.1 | Medium | 2023-10-20 |
| CVE-2023-4668 | WordPress Plugin Ad Inserter 安全漏洞 — Ad Inserter – Ad Manager & AdSense Ads | 5.3 | Medium | 2023-10-20 |
| CVE-2023-4941 | WordPress Plugin BEAR 安全漏洞 — BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | 4.3 | Medium | 2023-10-20 |
| CVE-2023-5533 | WordPress Plugin AI ChatBot 安全漏洞 — WPBot – AI ChatBot for Live Support, Lead Generation, AI Services | 5.3 | Medium | 2023-10-20 |
| CVE-2022-4943 | WordPress Plugin Google Authenticator 安全漏洞 — miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator) | 7.5 | High | 2023-10-20 |
| CVE-2023-4943 | WordPress Plugin BEAR 安全漏洞 — BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | 4.3 | Medium | 2023-10-20 |
| CVE-2023-4947 | WordPress Plugin WooCommerce EAN Payment Gateway 安全漏洞 — WooCommerce EAN Payment Gateway | 4.3 | Medium | 2023-10-20 |
| CVE-2020-36698 | WordPress Plugin Security & Malware scan by CleanTalk 安全漏洞 — Login Security, FireWall, Malware removal by CleanTalk | 8.8 | High | 2023-10-20 |
| CVE-2023-4645 | WordPress Plugin Ad Inserter 安全漏洞 — Ad Inserter – Ad Manager & AdSense Ads | 5.3 | Medium | 2023-10-19 |
| CVE-2023-4938 | WordPress Plugin BEAR 安全漏洞 — BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | 4.3 | Medium | 2023-10-18 |
| CVE-2023-42473 | SAP S/4HANA 安全漏洞 — S/4HANA (Manage Withholding Tax Items) | 5.4 | Medium | 2023-10-10 |
| CVE-2023-43700 | SICK APU 安全漏洞 — APU0200 | 7.7 | High | 2023-10-09 |
| CVE-2023-45247 | Acronis Agent 安全漏洞 — Acronis Cyber Protect Cloud Agent | 8.1 | - | 2023-10-09 |
| CVE-2023-5331 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2023-10-09 |
| CVE-2023-45246 | Acronis Agent 授权问题漏洞 — Acronis Cyber Protect Cloud Agent | 9.1 | - | 2023-10-06 |
| CVE-2023-45245 | Acronis Agent 安全漏洞 — Acronis Agent | 6.5 | - | 2023-10-06 |
| CVE-2023-45244 | Acronis Agent 安全漏洞 — Acronis Cyber Protect Cloud Agent | 9.1 | - | 2023-10-06 |
| CVE-2023-4469 | WordPress Plugin Profile Extra Fields by BestWebSoft 安全漏洞 — Profile Extra Fields by BestWebSoft | 5.3 | Medium | 2023-10-06 |
| CVE-2023-45243 | Acronis Agent 安全漏洞 — Acronis Cyber Protect Cloud Agent | 7.5 | - | 2023-10-05 |
| CVE-2023-45242 | Acronis Agent 安全漏洞 — Acronis Cyber Protect Cloud Agent | 7.5 | - | 2023-10-05 |
| CVE-2023-45240 | Acronis Agent 安全漏洞 — Acronis Agent | 7.5 | - | 2023-10-05 |
| CVE-2023-44214 | Acronis Agent 安全漏洞 — Acronis Agent | 7.5 | - | 2023-10-05 |
| CVE-2023-44211 | Acronis Agent 安全漏洞 — Acronis Cyber Protect Cloud Agent | 8.1 | - | 2023-10-05 |
| CVE-2023-44212 | Acronis Agent 安全漏洞 — Acronis Agent | 8.1 | - | 2023-10-05 |
| CVE-2023-44210 | Acronis Agent 安全漏洞 — Acronis Cyber Protect Cloud Agent | 8.1 | - | 2023-10-04 |
| CVE-2023-40376 | IBM UrbanCode Deploy 授权问题漏洞 — UrbanCode Deploy | 5.3 | Medium | 2023-10-04 |
| CVE-2023-44208 | Acronis Cyber Protect 安全漏洞 — Acronis Cyber Protect Home Office | 9.1 | - | 2023-10-04 |
| CVE-2023-3213 | WordPress Plugin WP Mail SMTP Pro 安全漏洞 — WP Mail SMTP Pro | 5.3 | Medium | 2023-10-04 |
| CVE-2023-5321 | inure 安全漏洞 — hamza417/inure | 8.8 | - | 2023-09-30 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 8301 条 CVE 漏洞。