CWE-266 特权授予不正确 类弱点 463 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-266属于权限分配错误漏洞，指软件将特权错误地授予特定主体，导致其获得非预期的控制范围。攻击者通常利用此缺陷，通过身份伪造或会话劫持等手段，以低权限身份获取高权限操作能力，从而执行未授权行为。开发者应避免在代码中硬编码权限逻辑，采用基于角色的访问控制（RBAC）机制，并在每次权限检查时动态验证主体身份与权限的匹配性，确保最小权限原则。
seteuid(0); /* do some stuff */ seteuid(getuid());AccessController.doPrivileged(new PrivilegedAction() { public Object run() { // privileged code goes here, for example: System.loadLibrary("awt"); return null; // nothing to return }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-4281 | Facepay 安全漏洞 — Facepay | 6.3 | Medium | 2022-12-05 |
| CVE-2022-4272 | FeMiner wms 代码问题漏洞 — wms | 6.3 | Medium | 2022-12-03 |
| CVE-2022-4273 | Human Resource Management System 代码问题漏洞 — Human Resource Management System | 7.3 | High | 2022-12-03 |
| CVE-2022-4276 | House Rental System 代码问题漏洞 — House Rental System | 6.3 | Medium | 2022-12-03 |
| CVE-2022-4280 | DIVOTECH Dot Tech Smart Campus System 安全漏洞 — Smart Campus System | 4.3 | Medium | 2022-12-03 |
| CVE-2022-4232 | Event Registration System 代码问题漏洞 — Event Registration System | 4.7 | Medium | 2022-11-30 |
| CVE-2022-3944 | jerryhanjj ERP 代码问题漏洞 — ERP | 6.3 | Medium | 2022-11-11 |
| CVE-2022-3826 | Huaxia ERP 安全漏洞 — ERP | 4.3 | Medium | 2022-11-02 |
| CVE-2022-3770 | Yunjing CMS 安全漏洞 — CMS | 6.3 | Medium | 2022-10-31 |
| CVE-2022-3771 | easyii CMS 代码问题漏洞 — CMS | 6.3 | Medium | 2022-10-31 |
| CVE-2022-3735 | seccome Ehoney 安全漏洞 — Ehoney | 6.3 | Medium | 2022-10-28 |
| CVE-2022-3549 | Simple Cold Storage Management System 代码问题漏洞 — Simple Cold Storage Management System | 4.7 | Medium | 2022-10-17 |
| CVE-2022-3496 | Human Resource Management System 安全漏洞 — Human Resource Management System | 6.3 | Medium | 2022-10-14 |
| CVE-2022-3458 | Human Resource Management System 安全漏洞 — Human Resource Management System | 6.3 | Medium | 2022-10-12 |
| CVE-2022-3436 | Web-Based Student Clearance System 代码问题漏洞 — Web-Based Student Clearance System | 6.3 | Medium | 2022-10-09 |
| CVE-2022-2637 | Hitachi Storage Plug-in for VMware vCenter 安全漏洞 — Hitachi Storage Plug-in for VMware vCenter | 5.4 | Medium | 2022-10-06 |
| CVE-2022-20855 | Cisco IOS XE Software 操作系统命令注入漏洞 — Cisco IOS XE Software | 7.9 | High | 2022-09-30 |
| CVE-2020-10728 | Automation Broker apb 安全漏洞 — automationbroker/apb | 7.8 | - | 2022-08-16 |
| CVE-2022-2626 | hestiacp 安全漏洞 — hestiacp/hestiacp | 6.5 | - | 2022-08-05 |
| CVE-2022-1746 | Dominion Voting Systems ImageCast X 安全漏洞 — ImageCast X application | 6.1 | - | 2022-06-24 |
| CVE-2022-20819 | Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software | 6.5 | Medium | 2022-06-15 |
| CVE-2022-20759 | 多款Cisco产品安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 8.8 | High | 2022-05-03 |
| CVE-2022-20681 | Cisco IOS XE Software安全漏洞 — Cisco IOS XE Software | 7.8 | High | 2022-04-15 |
| CVE-2022-20782 | Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software | 6.5 | Medium | 2022-04-06 |
| CVE-2022-1225 | phpIPAM 安全漏洞 — phpipam/phpipam | 6.5 | - | 2022-04-04 |
| CVE-2021-40124 | Cisco Anyconnect Secure Mobility Client安全漏洞 — Cisco AnyConnect Secure Mobility Client | 6.7 | Medium | 2021-11-04 |
| CVE-2021-40123 | Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software | 4.3 | Medium | 2021-10-21 |
| CVE-2021-36097 | OTRS 授权问题漏洞 — OTRS | 3.5 | Low | 2021-10-18 |
| CVE-2021-1594 | Cisco Identity Services Engine 操作系统命令注入漏洞 — Cisco Identity Services Engine Software | 7.5 | High | 2021-10-06 |
| CVE-2021-20264 | Red Hat ubi8/openjdk-11 安全漏洞 — containers/openjdk | 7.8 | - | 2021-10-06 |
CWE-266（特权授予不正确） 是常见的弱点类别，本平台收录该类弱点关联的 463 条 CVE 漏洞。