CWE-863 授权机制不正确 类弱点 2600 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-863属于授权检查缺陷，指系统在验证用户访问权限时未能正确执行检查逻辑。攻击者通常利用此漏洞，通过构造恶意请求或篡改参数，绕过权限控制以访问未授权资源或执行敏感操作。开发者应避免此问题，需确保在关键操作前严格验证用户身份与权限，采用最小权限原则，并实施集中式的授权管理，防止逻辑绕过或硬编码错误。
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-38368 | IBM Security Access Manager 安全漏洞 — Security Access Manager Docker | 5.5 | Medium | 2024-06-27 |
| CVE-2024-4011 | GitLab 访问控制错误漏洞 — GitLab | 3.1 | Low | 2024-06-26 |
| CVE-2024-6323 | GitLab 安全漏洞 — GitLab | 7.5 | High | 2024-06-26 |
| CVE-2024-38369 | XWiki Platform 安全漏洞 — xwiki-platform | 10.0 | Critical | 2024-06-24 |
| CVE-2023-38389 | WordPress plugin JupiterX Core 安全漏洞 — JupiterX Core | 9.8 | Critical | 2024-06-21 |
| CVE-2024-4390 | WordPress Plugin Slider and Carousel slider by Depicter 安全漏洞 — Depicter — Popup & Slider Builder | 6.5 | Medium | 2024-06-20 |
| CVE-2024-38329 | IBM Storage Protect 授权问题漏洞 — Storage Protect for Virtual Environments: Data Protection for VMware | 7.7 | High | 2024-06-19 |
| CVE-2024-34130 | Adobe Acrobat Mobile Sign Android 安全漏洞 — Acrobat Mobile Sign Android | 5.5 | Medium | 2024-06-13 |
| CVE-2024-34106 | Adobe Commerce 安全漏洞 — Adobe Commerce | 5.3 | Medium | 2024-06-13 |
| CVE-2024-37300 | OAuthenticator 安全漏洞 — oauthenticator | 8.1 | High | 2024-06-12 |
| CVE-2024-36265 | Apache Submarine 授权问题漏洞 — Apache Submarine Server Core | 7.5AI | High AI | 2024-06-12 |
| CVE-2024-2698 | Red Hat FreeIPA 安全漏洞 | 8.8 | High | 2024-06-12 |
| CVE-2024-0160 | Dell Client Platform 安全漏洞 — CPG BIOS | 6.8 | Medium | 2024-06-12 |
| CVE-2024-2473 | WordPress plugin WPS Hide Login 安全漏洞 — WPS Hide Login | 5.3 | Medium | 2024-06-11 |
| CVE-2024-4146 | Lunary 授权问题漏洞 — lunary-ai/lunary | 9.8 | Critical | 2024-06-08 |
| CVE-2024-3404 | ChuanhuChatGPT 访问控制错误漏洞 — gaizhenbiao/chuanhuchatgpt | 4.3AI | Medium AI | 2024-06-06 |
| CVE-2024-3504 | Lunary 安全漏洞 — lunary-ai/lunary | 4.9AI | Medium AI | 2024-06-06 |
| CVE-2024-3033 | AnythingLLM 授权问题漏洞 — mintplex-labs/anything-llm | 8.2AI | High AI | 2024-06-06 |
| CVE-2024-32983 | Misskey 安全漏洞 — misskey | 8.2 | High | 2024-06-03 |
| CVE-2024-36377 | JetBrains TeamCity 安全漏洞 — TeamCity | 6.5 | Medium | 2024-05-29 |
| CVE-2024-36376 | JetBrains TeamCity 安全漏洞 — TeamCity | 6.5 | Medium | 2024-05-29 |
| CVE-2024-36365 | JetBrains TeamCity 安全漏洞 — TeamCity | 6.8 | Medium | 2024-05-29 |
| CVE-2024-36364 | JetBrains TeamCity 安全漏洞 — TeamCity | 6.5 | Medium | 2024-05-29 |
| CVE-2024-36037 | Zoho ManageEngine ADAudit Plus 安全漏洞 — ADAudit Plus | 5.5 | Medium | 2024-05-27 |
| CVE-2024-27312 | Zoho ManageEngine PAM360 安全漏洞 — PAM360 | 8.1 | High | 2024-05-20 |
| CVE-2024-3745 | MSI Afterburner 安全漏洞 — MSI Afterburner | 7.8 | High | 2024-05-18 |
| CVE-2024-34434 | WordPress plugin WordPress Meta Data and Taxonomies Filter 安全漏洞 — WordPress Meta Data and Taxonomies Filter (MDTF) | 6.5 | Medium | 2024-05-17 |
| CVE-2024-35187 | Stalwart Mail Server 安全漏洞 — mail-server | 9.1 | Critical | 2024-05-16 |
| CVE-2024-31409 | Cyber Power Systems PowerPanel 授权问题漏洞 — PowerPanel business | 6.5 | Medium | 2024-05-15 |
| CVE-2024-34701 | CreateWiki 安全漏洞 — CreateWiki | 5.9 | Medium | 2024-05-13 |
CWE-863（授权机制不正确） 是常见的弱点类别，本平台收录该类弱点关联的 2600 条 CVE 漏洞。