CWE-862 授权机制缺失 类弱点 8301 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-862 属于缺失授权漏洞，指产品在用户访问资源或执行操作时未进行权限校验。攻击者通常通过直接修改请求参数或构造恶意 URL，绕过前端限制以访问未授权数据或执行敏感操作。开发者应避免仅依赖前端验证，需在服务端对每个请求实施严格的身份认证与权限检查，确保用户仅能访问其被授权的资源，从而从根本上消除越权风险。
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-2233 | GitLab Enterprise Edition 安全漏洞 — GitLab | 3.1 | Low | 2023-09-29 |
| CVE-2023-43652 | JumpServer 安全漏洞 — jumpserver | 8.2 | High | 2023-09-27 |
| CVE-2023-20252 | Cisco Catalyst SD-WAN Manager 授权问题漏洞 — Cisco SD-WAN vManage | 9.8 | Critical | 2023-09-27 |
| CVE-2023-5165 | Docker Desktop 安全漏洞 — Docker Desktop | 7.1 | High | 2023-09-25 |
| CVE-2023-41296 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 7.1 | - | 2023-09-25 |
| CVE-2023-5054 | WordPress plugin Super Store Finder 安全漏洞 — Super Store Finder | 5.8 | Medium | 2023-09-19 |
| CVE-2023-0923 | Red Hat OpenShift 安全漏洞 — RHODS-1.22-RHEL-8 | 8.8 | High | 2023-09-15 |
| CVE-2023-4948 | WordPress Plugin WooCommerce CVR Payment Gateway 安全漏洞 — WooCommerce CVR Payment Gateway | 4.3 | Medium | 2023-09-14 |
| CVE-2023-40625 | SAP S4CORE 安全漏洞 — SAP Manage Purchase Contracts App | 5.4 | Medium | 2023-09-12 |
| CVE-2023-4630 | GitLab 安全漏洞 — GitLab | 5.0 | Medium | 2023-09-11 |
| CVE-2023-4792 | WordPress plugin Duplicate Post Page Menu & Custom Post Type 安全漏洞 — Duplicate Post Page Menu & Custom Post Type | 4.3 | Medium | 2023-09-07 |
| CVE-2023-41046 | XWiki Platform 安全漏洞 — xwiki-platform | 6.3 | Medium | 2023-09-01 |
| CVE-2023-41750 | Acronis Agent 安全漏洞 — Acronis Agent | 7.5 | - | 2023-08-31 |
| CVE-2023-2174 | WordPress plugin BadgeOS 安全漏洞 — BadgeOS | 4.3 | Medium | 2023-08-31 |
| CVE-2023-2353 | WordPress plugin CHP Ads Block Detector 安全漏洞 — CHP Ads Block Detector | 4.3 | Medium | 2023-08-31 |
| CVE-2023-3999 | WordPress plugin Waiting: One-click countdowns 安全漏洞 — Waiting: One-click countdowns | 6.3 | Medium | 2023-08-31 |
| CVE-2023-4245 | WordPress plugin WooCommerce PDF Invoice Builder 安全漏洞 — PDF Builder for WooCommerce. Create invoices,packing slips and more | 4.3 | Medium | 2023-08-31 |
| CVE-2023-4302 | Jenkins Plugin Fortify 安全漏洞 — Jenkins Fortify Plugin | 4.2 | Medium | 2023-08-21 |
| CVE-2023-4434 | inure 安全漏洞 — hamza417/inure | 8.8 | - | 2023-08-20 |
| CVE-2023-3244 | WordPress Plugin Comments Like Dislike 安全漏洞 — Comments Like Dislike | 4.3 | Medium | 2023-08-17 |
| CVE-2023-4374 | WordPress Plugin Remote Users Sync 安全漏洞 — WP Remote Users Sync | 4.3 | Medium | 2023-08-16 |
| CVE-2023-40027 | Keystone 安全漏洞 — keystone | 3.7 | Low | 2023-08-15 |
| CVE-2023-39438 | Contributor License Agreement assistant 安全漏洞 — CLA Assistant | 8.1 | High | 2023-08-15 |
| CVE-2023-4106 | Mattermost 安全漏洞 — Mattermost | 6.3 | Medium | 2023-08-11 |
| CVE-2023-4105 | Mattermost 安全漏洞 — Mattermost | 3.1 | Low | 2023-08-11 |
| CVE-2023-39966 | 1Panel 安全漏洞 — 1Panel | 7.5 | High | 2023-08-10 |
| CVE-2023-4282 | WordPress Plugin EmbedPress 安全漏洞 — EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more | 5.4 | Medium | 2023-08-10 |
| CVE-2023-37862 | PHOENIX CONTACTs WP 6xxx series web panels 安全漏洞 — WP 6070-WVPS | 8.2 | High | 2023-08-09 |
| CVE-2023-37860 | PHOENIX CONTACTs WP 6xxx series web panels 安全漏洞 — WP 6070-WVPS | 7.5 | High | 2023-08-09 |
| CVE-2023-4124 | answer 安全漏洞 — answerdev/answer | - | - | 2023-08-03 |
CWE-862（授权机制缺失） 是常见的弱点类别，本平台收录该类弱点关联的 8301 条 CVE 漏洞。