CWE-863 授权机制不正确 类弱点 2600 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-863属于授权检查缺陷，指系统在验证用户访问权限时未能正确执行检查逻辑。攻击者通常利用此漏洞，通过构造恶意请求或篡改参数，绕过权限控制以访问未授权资源或执行敏感操作。开发者应避免此问题，需确保在关键操作前严格验证用户身份与权限，采用最小权限原则，并实施集中式的授权管理，防止逻辑绕过或硬编码错误。
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-4268 | phpRedisAdmin 跨站请求伪造漏洞 — phpRedisAdmin | 4.3 | Medium | 2022-12-21 |
| CVE-2021-4275 | pyambic-pentameter 跨站请求伪造漏洞 — pyambic-pentameter | 4.3 | Medium | 2022-12-21 |
| CVE-2022-42351 | Adobe Experience Manager 安全漏洞 — Experience Manager | 4.3 | Medium | 2022-12-19 |
| CVE-2022-41962 | BigBlueButton 安全漏洞 — bigbluebutton | 2.7 | Low | 2022-12-16 |
| CVE-2022-23741 | GitHub Enterprise Server 安全漏洞 — GitHub Enterprise Server | 7.2 | - | 2022-12-14 |
| CVE-2022-23473 | Tuleap 安全漏洞 — tuleap | 4.3 | Medium | 2022-12-13 |
| CVE-2022-46160 | Tuleap 安全漏洞 — tuleap | 4.3 | Medium | 2022-12-13 |
| CVE-2022-41274 | SAP Disclosure Management 信息泄露漏洞 — Disclosure Management | 6.5 | Medium | 2022-12-13 |
| CVE-2022-4397 | Zend-blog-2 跨站请求伪造漏洞 — zend-blog-number-2 | 4.3 | Medium | 2022-12-10 |
| CVE-2020-36610 | DuxCMS 安全漏洞 — DuxCMS | 4.3 | Medium | 2022-12-08 |
| CVE-2022-4349 | Pwn 跨站请求伪造漏洞 — pwn | 4.3 | Medium | 2022-12-08 |
| CVE-2022-46167 | Capsule Console 安全漏洞 — capsule | 8.8 | High | 2022-12-02 |
| CVE-2022-4090 | Stock Management System 跨站请求伪造漏洞 — Stock Management System | 4.3 | Medium | 2022-11-24 |
| CVE-2022-4013 | Hospital Management System 跨站请求伪造漏洞 — Hospital Management Center | 4.3 | Medium | 2022-11-16 |
| CVE-2022-4014 | FeehiCMS 跨站请求伪造漏洞 — FeehiCMS | 4.3 | Medium | 2022-11-16 |
| CVE-2022-41918 | OpenSearch Project 安全漏洞 — security | 6.3 | Medium | 2022-11-15 |
| CVE-2022-3978 | NodeBB 跨站请求伪造漏洞 — NodeBB | 4.3 | Medium | 2022-11-13 |
| CVE-2022-20928 | Cisco Adaptive Security Appliance（ASA）Software和Cisco Firepower Threat Defense（FTD）Software 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 5.8 | Medium | 2022-11-10 |
| CVE-2022-39388 | Istio 安全漏洞 — istio | 7.6 | High | 2022-11-10 |
| CVE-2022-39352 | OpenFGA 安全漏洞 — openfga | 4.8 | Medium | 2022-11-08 |
| CVE-2022-42344 | Adobe Commerce 输入验证错误漏洞 — Adobe Commerce | 8.8 | High | 2022-10-20 |
| CVE-2022-3582 | Simple Cold Storage Management System 跨站请求伪造漏洞 — Simple Cold Storage Management System | 4.3 | Medium | 2022-10-18 |
| CVE-2022-3585 | Simple Cold Storage Management System 安全漏洞 — Simple Cold Storage Management System | 4.3 | Medium | 2022-10-18 |
| CVE-2022-39302 | Ree6 安全漏洞 — Ree6 | 5.5 | Medium | 2022-10-13 |
| CVE-2022-31252 | openSUSE 安全漏洞 — SUSE Linux Enterprise Server 12-SP5 | 4.4 | Medium | 2022-10-06 |
| CVE-2022-39275 | saleor 输入验证错误漏洞 — saleor | 5.3 | Medium | 2022-10-06 |
| CVE-2022-3024 | WordPress plugin Simple Bitcoin Faucets 安全漏洞 — Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi Games, Referral Program | 7.6 | - | 2022-09-26 |
| CVE-2022-39955 | OWASP ModSecurity Core Rule Set 安全漏洞 — ModSecurity Core Rule Set | 7.3 | High | 2022-09-20 |
| CVE-2022-39956 | OWASP ModSecurity Core Rule Set 安全漏洞 — ModSecurity Core Rule Set | 7.3 | High | 2022-09-20 |
| CVE-2022-39958 | OWASP ModSecurity Core Rule Set 安全漏洞 — ModSecurity Core Rule Set | 7.5 | High | 2022-09-20 |
CWE-863（授权机制不正确） 是常见的弱点类别，本平台收录该类弱点关联的 2600 条 CVE 漏洞。