CWE-863 授权机制不正确 类弱点 2077 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-863属于授权检查缺陷，指系统在验证用户访问权限时未能正确执行检查逻辑。攻击者通常利用此漏洞，通过构造恶意请求或篡改参数，绕过权限控制以访问未授权资源或执行敏感操作。开发者应避免此问题，需确保在关键操作前严格验证用户身份与权限，采用最小权限原则，并实施集中式的授权管理，防止逻辑绕过或硬编码错误。
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-46308 | SGUDA U-Lock 安全漏洞 — U-Lock | 8.8 | High | 2023-06-02 |
| CVE-2022-46307 | SGUDA U-Lock 安全漏洞 — U-Lock | 8.8 | High | 2023-06-02 |
| CVE-2023-34218 | JetBrains TeamCity 安全漏洞 — TeamCity | 9.1 | Critical | 2023-05-31 |
| CVE-2023-1158 | Hitachi Vantara Pentaho Business Analytics Server 安全漏洞 — Pentaho Business Analytics Server | 4.3 | Medium | 2023-05-24 |
| CVE-2023-2515 | Mattermost 安全漏洞 — Mattermost | 4.7 | Medium | 2023-05-12 |
| CVE-2023-32069 | XWiki Platform 安全漏洞 — xwiki-platform | 10.0 | Critical | 2023-05-09 |
| CVE-2023-31141 | OpenSearch 安全漏洞 — security | 4.8 | Medium | 2023-05-08 |
| CVE-2023-30840 | Fluid 安全漏洞 — fluid | 5.8 | Medium | 2023-05-08 |
| CVE-2023-1979 | WordPress plugin Web Stories 安全漏洞 — Web Stories for WordPress | 4.9 | Medium | 2023-05-08 |
| CVE-2023-29240 | F5 BIG-IQ 代码问题漏洞 — BIG-IQ | 5.4 | Medium | 2023-05-03 |
| CVE-2023-25548 | Schneider Electric StruxureWare Data Center Expert 安全漏洞 — StruxureWare Data Center Expert | 8.8 | High | 2023-04-18 |
| CVE-2023-25547 | Schneider Electric StruxureWare Data Center Expert 安全漏洞 — StruxureWare Data Center Expert | 8.8 | High | 2023-04-18 |
| CVE-2023-27525 | Apache Superset 安全漏洞 — Apache Superset | 3.1 | Low | 2023-04-17 |
| CVE-2023-30771 | Apache IoTDB 安全漏洞 — Apache IoTDB Workbench | 9.8 | - | 2023-04-17 |
| CVE-2022-40682 | Fortinet FortiClient 安全漏洞 — FortiClientWindows | 7.1 | High | 2023-04-11 |
| CVE-2022-43770 | Hitachi Vantara Pentaho Business Analytics Server 安全漏洞 — Pentaho Business Analytics Server | 5.4 | Medium | 2023-04-11 |
| CVE-2022-43940 | Hitachi Vantara Pentaho Business Analytics Server 安全漏洞 — Pentaho Business Analytics Server | 8.8 | High | 2023-04-03 |
| CVE-2022-27642 | NETGEAR R6700v3 信息泄露漏洞 — R6700v3 | 8.8 | - | 2023-03-29 |
| CVE-2023-22251 | Adobe Commerce 安全漏洞 — Magento Commerce | 4.3 | Medium | 2023-03-27 |
| CVE-2023-25017 | RIFARTEK IOT Wall 安全漏洞 — IOT Wall | 8.1 | High | 2023-03-27 |
| CVE-2023-25923 | IBM Security Guardium 安全漏洞 — Security Key Lifecycle Manager | 2.7 | Low | 2023-03-21 |
| CVE-2023-25924 | IBM Security Guardium 安全漏洞 — Security Key Lifecycle Manager | 5.4 | Medium | 2023-03-21 |
| CVE-2023-26484 | KubeVirt 安全漏洞 — kubevirt | 8.2 | High | 2023-03-15 |
| CVE-2022-39214 | Combodo iTop 安全漏洞 — iTop | 9.6 | Critical | 2023-03-14 |
| CVE-2023-24999 | HashiCorp Vault 安全漏洞 — Vault | 4.4 | Medium | 2023-03-10 |
| CVE-2023-27486 | xCAT 安全漏洞 — xcat-core | 8.1 | High | 2023-03-08 |
| CVE-2023-27485 | Feedbacksystem 安全漏洞 — feedbacksystem | 4.3 | Medium | 2023-03-07 |
| CVE-2023-26056 | XWiki Platform 安全漏洞 — xwiki-platform | 5.4 | Medium | 2023-03-02 |
| CVE-2023-23947 | ArgoCD 安全漏洞 — argo-cd | 9.1 | Critical | 2023-02-16 |
| CVE-2023-25173 | containerd 安全漏洞 — containerd | 5.3 | Medium | 2023-02-16 |
CWE-863（授权机制不正确） 是常见的弱点类别，本平台收录该类弱点关联的 2077 条 CVE 漏洞。