CWE-942 过度许可的跨域白名单 类弱点 82 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-942属于跨域安全策略配置错误漏洞。当Web应用允许与不受信任的域进行通信时，攻击者可利用该缺陷通过恶意域窃取敏感数据或执行未授权操作。开发者应避免在内容安全策略或跨域策略文件中包含通配符或不可信域名，严格限制允许通信的源，确保仅信任已知且安全的域，从而防止跨域数据泄露。
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"> <allow-access-from domain="*.example.com"/> <allow-access-from domain="*"/> </cross-domain-policy><?xml version="1.0" encoding="utf-8"?> <access-policy> <cross-domain-access> <policy> <allow-from http-request-headers="SOAPAction"> <domain uri="*"/> </allow-from> <grant-to> <resource path="/" include-subpaths="true"/> </grant-to> </policy> </cross-domain-access> </access-policy>| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-45642 | IBM Security ReaQta 安全漏洞 — Security ReaQta | 5.3 | Medium | 2024-11-14 |
| CVE-2024-10315 | Perforce Gliffy 安全漏洞 — Gliffy Online | 9.4AI | Critical AI | 2024-11-11 |
| CVE-2024-6449 | HyperView Geoportal Toolkit 安全漏洞 — Geoportal Toolkit | 6.5AI | Medium AI | 2024-08-28 |
| CVE-2024-41657 | Casdoor 安全漏洞 — casdoor | 8.1 | High | 2024-08-20 |
| CVE-2024-41659 | Memos 安全漏洞 — memos | 8.1 | High | 2024-08-20 |
| CVE-2024-32862 | Johnson Controls exacqVision Web Service 安全漏洞 — exacqVision | 6.8 | Medium | 2024-08-01 |
| CVE-2024-37131 | Dell Secure Connect Gateway 安全漏洞 — Secure Connect Gateway (SCG) Policy Manager | 7.5 | High | 2024-06-13 |
| CVE-2023-38125 | Softing edgeAggregator 安全漏洞 — edgeAggregator | 8.8 | - | 2024-05-03 |
| CVE-2023-38122 | Inductive Automation Ignition 安全漏洞 — Ignition | 8.8 | - | 2024-05-03 |
| CVE-2024-23823 | vantage6 安全漏洞 — vantage6 | 4.2 | Medium | 2024-03-14 |
| CVE-2023-45213 | Westermo Lynx 206-F2G 安全漏洞 — Lynx | 6.6 | Medium | 2024-02-06 |
| CVE-2023-50940 | IBM PowerSC 安全漏洞 — PowerSC | 5.3 | Medium | 2024-02-02 |
| CVE-2024-21382 | Microsoft Edge 安全漏洞 — Microsoft Edge (Chromium-based) | 4.3 | Medium | 2024-01-26 |
| CVE-2023-46281 | Siemens Opcenter Quality 安全漏洞 — Opcenter Execution Foundation | 7.1 | High | 2023-12-12 |
| CVE-2023-25603 | Fortinet FortiADC 安全漏洞 — FortiDDoS-F | 5.4 | Medium | 2023-11-14 |
| CVE-2023-46098 | Siemens SIMATIC PCS 安全漏洞 — SIMATIC PCS neo | 8.0 | High | 2023-11-14 |
| CVE-2023-36829 | Mobileiron Sentry 安全漏洞 — sentry | 6.8 | Medium | 2023-07-06 |
| CVE-2023-2360 | Acronis Cyber Infrastructure 安全漏洞 — Acronis Cyber Infrastructure | 7.5 | - | 2023-04-28 |
| CVE-2022-34366 | Dell SupportAssist for Home PCs 安全漏洞 — SupportAssist Client Consumer | 6.5 | Medium | 2023-02-10 |
| CVE-2021-27786 | HCL Technologies OneTest Server 安全漏洞 — HCL OneTest Server | 4.6 | Medium | 2022-06-07 |
| CVE-2021-34435 | Eclipse Theia 访问控制错误漏洞 — Eclipse Theia | 8.8 | - | 2021-09-01 |
| CVE-2019-14860 | Red Hat Fuse 输入验证错误漏洞 — syndesis | 7.1 | - | 2019-11-08 |
CWE-942（过度许可的跨域白名单） 是常见的弱点类别，本平台收录该类弱点关联的 82 条 CVE 漏洞。