CWE-863 授权机制不正确 类弱点 2077 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-863属于授权检查缺陷，指系统在验证用户访问权限时未能正确执行检查逻辑。攻击者通常利用此漏洞，通过构造恶意请求或篡改参数，绕过权限控制以访问未授权资源或执行敏感操作。开发者应避免此问题，需确保在关键操作前严格验证用户身份与权限，采用最小权限原则，并实施集中式的授权管理，防止逻辑绕过或硬编码错误。
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-31155 | Sourcegraph 安全漏洞 — sourcegraph | 4.3 | Medium | 2022-08-01 |
| CVE-2022-31154 | Sourcegraph 安全漏洞 — sourcegraph | 6.4 | Medium | 2022-08-01 |
| CVE-2022-0670 | Red Hat Ceph 安全漏洞 — Ceph | 8.1 | - | 2022-07-25 |
| CVE-2022-0594 | WordPress plugin Shareaholic 信息泄露漏洞 — Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic | 5.3 | - | 2022-07-25 |
| CVE-2022-31107 | Grafana 授权问题漏洞 — grafana | 7.1 | High | 2022-07-15 |
| CVE-2022-29619 | SAP BusinessObjects Business Intelligence Platform 安全漏洞 — SAP BusinessObjects Business Intelligence Platform | 8.1 | - | 2022-07-12 |
| CVE-2022-32532 | Apache Shiro 安全漏洞 — Apache Shiro | 9.8 | - | 2022-06-28 |
| CVE-2022-31589 | 多款SAP产品安全漏洞 — SAP ERP, localization for CEE countries. | 6.5 | - | 2022-06-14 |
| CVE-2022-27668 | SAP NetWeaver 和 ABAP Platform 安全漏洞 — SAP NetWeaver and ABAP Platform | 9.8 | - | 2022-06-14 |
| CVE-2022-30311 | Festo Controller CECC-X-M1 操作系统命令注入漏洞 — Controller CECC-X-M1 (4407603) | 9.8 | Critical | 2022-06-13 |
| CVE-2022-30310 | Festo Controller CECC-X-M1 操作系统命令注入漏洞 — Controller CECC-X-M1 (4407603) | 9.8 | Critical | 2022-06-13 |
| CVE-2022-30309 | Festo Controller CECC-X-M1 操作系统命令注入漏洞 — Controller CECC-X-M1 (4407603) | 9.8 | Critical | 2022-06-13 |
| CVE-2022-30308 | Festo Controller CECC-X-M1 操作系统命令注入漏洞 — Controller CECC-X-M1 (4407603) | 9.8 | Critical | 2022-06-13 |
| CVE-2022-22978 | VMware Spring Security 授权问题漏洞 — Spring Security | 9.8 | - | 2022-05-19 |
| CVE-2021-3956 | Lenovo XClarity Controller 安全漏洞 — XClarity Controller (XCC) | 4.3 | Medium | 2022-05-18 |
| CVE-2022-1706 | Ignition 访问控制错误漏洞 — coreos/ignition | 6.5 | - | 2022-05-17 |
| CVE-2022-28774 | SAP Host Agent 信息泄露漏洞 — SAP Host Agent | 5.5 | - | 2022-05-11 |
| CVE-2022-0866 | Wildfly 安全漏洞 — Wildfly | 8.2 | - | 2022-05-10 |
| CVE-2021-36778 | Rancher Labs Rancher 安全漏洞 — Rancher | 7.3 | High | 2022-05-02 |
| CVE-2022-0984 | Moodle 访问控制错误漏洞 — moodle | 4.3 | - | 2022-04-29 |
| CVE-2022-23822 | Xilinx Zynq-7000 安全漏洞 — Zynq-7000 SoC FSBL | 6.8 | - | 2022-04-27 |
| CVE-2022-1466 | Red Hat Single Sign-On 安全漏洞 — rhsso | 6.5 | - | 2022-04-26 |
| CVE-2020-25167 | Osisoft OSIsoft PI和OSIsoft PI Vision 安全漏洞 — PI Vision | 4.9 | Medium | 2022-04-18 |
| CVE-2022-0920 | WordPress plugin 安全漏洞 — Salon booking system | 7.5 | - | 2022-04-11 |
| CVE-2022-27609 | Forcepoint One Endpoint安全漏洞 — One Endpoint | 6.0 | Medium | 2022-04-04 |
| CVE-2022-27608 | Forcepoint One Endpoint安全漏洞 — One Endpoint | 6.0 | Medium | 2022-04-04 |
| CVE-2022-0825 | WordPress plugin Amelia 安全漏洞 — Amelia – Events & Appointments Booking Calendar | 5.4 | - | 2022-04-04 |
| CVE-2022-1223 | phpIPAM 访问控制错误漏洞 — phpipam/phpipam | 6.5 | Medium | 2022-04-04 |
| CVE-2021-3456 | Foreman 安全漏洞 — smart_proxy_salt | 7.3 | - | 2022-03-30 |
| CVE-2020-35501 | Linux kernel 安全漏洞 — kernel | 4.4 | - | 2022-03-30 |
CWE-863（授权机制不正确） 是常见的弱点类别，本平台收录该类弱点关联的 2077 条 CVE 漏洞。