目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-141 参数分隔符转义处理不恰当 类漏洞列表 7

CWE-141 参数分隔符转义处理不恰当 类弱点 7 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-141属于参数注入类漏洞，指程序未正确过滤上游输入中的特殊分隔符。攻击者通过注入或篡改分隔符，误导下游组件解析逻辑，从而执行非预期操作。开发者应严格验证并转义输入数据，确保分隔符不被误读，同时采用白名单机制限制合法字符，从根本上阻断恶意注入路径，保障系统安全。

MITRE CWE 官方描述
CWE：CWE-141 参数/参数分隔符的不当中和 英文：产品从上游组件接收输入，但未对特殊元素进行中和或进行了不正确的中和，而这些特殊元素在发送给下游组件时可能被解释为参数或参数分隔符。 在解析数据时，注入的/缺失的/格式错误的分隔符可能导致进程采取意外操作。
常见影响 (1)
IntegrityUnexpected State
缓解措施 (4)
Developers should anticipate that parameter/argument delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
ImplementationWhile it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or whit…
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CVE ID标题CVSS风险等级Published
CVE-2025-20338 Cisco IOS XE 安全漏洞 — Cisco IOS XE Software 6.0 Medium2025-09-24
CVE-2025-31329 SAP NetWeaver 安全漏洞 — SAP NetWeaver Application Server ABAP and ABAP Platform 6.2 Medium2025-05-13
CVE-2024-0840 Grandstream UCM Series IP PBX 安全漏洞 — UCM Series 8.8 High2024-04-29
CVE-2022-41665 Siemens SICAM P850 和SICAM P855 安全漏洞 — SICAM P850 9.8 Critical2022-10-11
CVE-2022-29873 Siemens SICAM 安全漏洞 — SICAM T 9.8 Critical2022-05-10
CVE-2022-29872 Siemens SICAM 输入验证错误漏洞 — SICAM T 8.8 High2022-05-10
CVE-2020-7868 HelpU 安全漏洞 — helpu.ocx 9.6 Critical2021-06-29

CWE-141（参数分隔符转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 7 条 CVE 漏洞。