CWE-863 授权机制不正确 类弱点 2077 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-863属于授权检查缺陷，指系统在验证用户访问权限时未能正确执行检查逻辑。攻击者通常利用此漏洞，通过构造恶意请求或篡改参数，绕过权限控制以访问未授权资源或执行敏感操作。开发者应避免此问题，需确保在关键操作前严格验证用户身份与权限，采用最小权限原则，并实施集中式的授权管理，防止逻辑绕过或硬编码错误。
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-3484 | GitLab 安全漏洞 — GitLab | 8.0 | High | 2023-07-21 |
| CVE-2023-3459 | WordPress Plugin Export and Import Users and Customers 安全漏洞 — Export and Import Users and Customers | 7.2 | High | 2023-07-18 |
| CVE-2023-3613 | Mattermost 安全漏洞 — Mattermost Plugins | 3.5 | Low | 2023-07-17 |
| CVE-2023-3590 | Mattermost 安全漏洞 — Mattermost | 3.1 | Low | 2023-07-17 |
| CVE-2023-3586 | Mattermost 安全漏洞 — Mattermost | 4.2 | Medium | 2023-07-17 |
| CVE-2023-3584 | Mattermost 安全漏洞 — Mattermost | 3.1 | Low | 2023-07-17 |
| CVE-2023-3582 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2023-07-17 |
| CVE-2023-2759 | TapHome 授权问题漏洞 — Core Platform | 8.8 | High | 2023-07-17 |
| CVE-2023-2576 | GitLab 安全漏洞 — GitLab | 4.3 | Medium | 2023-07-13 |
| CVE-2023-3444 | GitLab 注入漏洞 — GitLab | 5.7 | Medium | 2023-07-13 |
| CVE-2023-35908 | Apache Airflow 安全漏洞 — Apache Airflow | 5.3 | - | 2023-07-12 |
| CVE-2023-30428 | Apache Pulsar 安全漏洞 — Apache Pulsar Broker | 8.2 | High | 2023-07-12 |
| CVE-2023-30429 | Apache Pulsar 安全漏洞 — Apache Pulsar | 9.6 | Critical | 2023-07-12 |
| CVE-2023-37579 | Apache Pulsar 安全漏洞 — Apache Pulsar Function Worker | 8.2 | High | 2023-07-12 |
| CVE-2023-3485 | Temporal Server 安全漏洞 — Temporal Server | 3.0 | Low | 2023-06-30 |
| CVE-2023-35165 | AWS Cloud Development Kit 安全漏洞 — aws-cdk | 6.6 | Medium | 2023-06-23 |
| CVE-2023-0971 | SiLabs Z-Wave over IP Gateway 安全漏洞 — Z/IP Gateway | 9.6 | Critical | 2023-06-21 |
| CVE-2023-35166 | XWiki Platform 安全漏洞 — xwiki-platform | 10.0 | Critical | 2023-06-20 |
| CVE-2022-22307 | IBM Security Guardium 安全漏洞 — Security Guardium | 4.4 | Medium | 2023-06-15 |
| CVE-2023-29296 | Adobe Commerce 安全漏洞 — Magento Commerce | 4.3 | Medium | 2023-06-15 |
| CVE-2023-29295 | Adobe Commerce 安全漏洞 — Magento Commerce | 4.3 | Medium | 2023-06-15 |
| CVE-2023-29288 | Adobe Commerce 安全漏洞 — Adobe Commerce | 4.3 | Medium | 2023-06-15 |
| CVE-2023-22248 | Adobe Commerce 安全漏洞 — Magento Commerce | 7.5 | High | 2023-06-15 |
| CVE-2023-32061 | Discourse 安全漏洞 — discourse | 5.4 | Medium | 2023-06-13 |
| CVE-2020-36710 | WordPress Plugin WPS Hide Login 安全漏洞 — WPS Hide Login | 5.3 | Medium | 2023-06-07 |
| CVE-2023-32683 | Matrix Synapse 代码问题漏洞 — synapse | 3.5 | Low | 2023-06-06 |
| CVE-2023-1779 | MB connect line mbCONNECT24和mymbCONNECT24 信息泄露漏洞 — mbCONNECT24 | 4.3 | Medium | 2023-06-06 |
| CVE-2023-3066 | Mobatime 安全漏洞 — Mobatime mobile application AMXGT100 | 8.1 | High | 2023-06-05 |
| CVE-2023-3033 | Mobatime 安全漏洞 — Mobatime web application | 6.8 | Medium | 2023-06-02 |
| CVE-2023-28698 | Wade Graphic Design FANTSY 安全漏洞 — FANTSY | 9.8 | Critical | 2023-06-02 |
CWE-863（授权机制不正确） 是常见的弱点类别，本平台收录该类弱点关联的 2077 条 CVE 漏洞。