目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-271 特权放弃/降低错误 类漏洞列表 11

CWE-271 特权放弃/降低错误 类弱点 11 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-271属于权限管理缺陷，指程序在将资源控制权移交低权限实体前，未正确降低自身特权。攻击者常利用此漏洞，通过诱导高权限进程将资源传递给恶意用户，从而窃取或滥用系统级权限，导致特权扩散。开发者应严格遵循最小权限原则，在资源移交前显式调用权限降级机制，并实施严格的访问控制检查，确保特权仅保留在必要范围内。

MITRE CWE 官方描述
CWE：CWE-271 Privilege Dropping / Lowering Errors（权限降低/降级错误） 英文：产品在将资源控制权传递给不具备这些权限的参与者之前，未执行权限降低操作。 在某些上下文中，以 elevated permissions（提升权限）运行的系统会将进程/文件等移交（hand off）给另一个进程或用户。如果未降低实体的权限，则 elevated privileges（提升权限）将在整个系统中蔓延，并可能扩散至攻击者。
常见影响 (2)
Access ControlGain Privileges or Assume Identity
If privileges are not dropped, neither are access rights of the user. Often these rights can be prevented from being dropped.
Access Control, Non-RepudiationGain Privileges or Assume Identity, Hide Activities
If privileges are not dropped, in some cases the system may record actions as the user which is being impersonated rather than the impersonator.
缓解措施 (3)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Architecture and Design, OperationVery carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and DesignConsider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
代码示例 (1)
The following code calls chroot() to restrict the application to a subset of the filesystem below APP_HOME in order to prevent an attacker from using the program to gain unauthorized access to files located elsewhere. The code then opens a file specified by the user and processes the contents of the file.
chroot(APP_HOME); chdir("/"); FILE* data = fopen(argv[1], "r+"); ...
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2026-35535 Sudo 安全漏洞 — Sudo 7.4 High2026-04-03
CVE-2026-25704 cosmic-greeter 安全漏洞 — cosmic-greeter 8.1AIHighAI2026-03-30
CVE-2025-53819 Nix 安全漏洞 — nix 7.9 High2025-07-14
CVE-2025-23395 GNU Screen 安全漏洞 7.8 High2025-05-26
CVE-2024-35179 Stalwart Mail Server 安全漏洞 — mail-server 6.8 Medium2024-05-15
CVE-2024-0985 PostgreSQL 安全漏洞 — PostgreSQL 8.0 High2024-02-08
CVE-2023-38496 Apptainer 安全漏洞 — apptainer 6.1 Medium2023-07-25
CVE-2023-22648 Rancher Labs Rancher 安全漏洞 — Rancher 8.0 High2023-06-01
CVE-2022-3569 Zimbra Collaboration Suite 安全漏洞 — Zimbra Collaboration Suite (ZCS) 7.8 -2022-10-17
CVE-2020-35513 Linux Kernel NFS 安全漏洞 — kernel 4.9 -2021-01-25
CVE-2019-11243 Google Kubernetes 信任管理问题漏洞 — Kubernetes 8.1 -2019-04-22

CWE-271（特权放弃/降低错误） 是常见的弱点类别，本平台收录该类弱点关联的 11 条 CVE 漏洞。