目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-273 对于放弃特权的检查不恰当 类漏洞列表 12

CWE-273 对于放弃特权的检查不恰当 类弱点 12 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-273属于权限管理缺陷，指程序在尝试降低权限时未正确验证操作是否成功。若降权失败，程序仍维持高权限运行，攻击者可利用此漏洞获取未授权访问，执行敏感操作或提升自身权限。开发者应在代码中严格检查降权调用的返回值，确保权限已成功降低，并在失败时立即终止程序或采取安全回退措施，以杜绝特权残留风险。

MITRE CWE 官方描述
CWE：CWE-273 权限降低检查不当 英文：产品尝试降低权限，但未检查或错误地检查权限降低是否成功。 如果权限降低失败，产品将继续以提升的权限运行，这可能会为未授权用户提供额外的访问权限。
常见影响 (2)
Access ControlGain Privileges or Assume Identity
If privileges are not dropped, neither are access rights of the user. Often these rights can be prevented from being dropped.
Access Control, Non-RepudiationGain Privileges or Assume Identity, Hide Activities
If privileges are not dropped, in some cases the system may record actions as the user which is being impersonated rather than the impersonator.
缓解措施 (3)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
ImplementationCheck the results of all functions that return a value and verify that the value is expected.
Effectiveness: High
ImplementationIn Windows, make sure that the process token has the SeImpersonatePrivilege(Microsoft Server 2003). Code that relies on impersonation for security must ensure that the impersonation succeeded, i.e., that a proper privilege demotion happened.
代码示例 (1)
This code attempts to take on the privileges of a user before creating a file, thus avoiding performing the action with unnecessarily high privileges:
bool DoSecureStuff(HANDLE hPipe) { bool fDataWritten = false; ImpersonateNamedPipeClient(hPipe); HANDLE hFile = CreateFile(...); /../ RevertToSelf() /../ }
Bad · C++
CVE ID标题CVSS风险等级Published
CVE-2026-32107 xrdp 安全漏洞 — xrdp 8.8 High2026-04-17
CVE-2026-21882 The Shit 安全漏洞 — theshit 8.4 High2026-03-02
CVE-2025-62175 Mastodon 安全漏洞 — mastodon 4.3 Medium2025-10-13
CVE-2025-27396 Siemens SCALANCE LPE9403 安全漏洞 — SCALANCE LPE9403 8.8 High2025-03-11
CVE-2025-1003 HP Anyware 安全漏洞 — HP Anyware Linux Agent 8.8 -2025-02-03
CVE-2023-0657 编号已被CVE保留 3.4 Low2024-11-17
CVE-2024-38813 VMware vCenter Server 安全漏洞 — VMware vCenter Server 7.5 High2024-09-17
CVE-2023-5369 FreeBSD 安全漏洞 — FreeBSD 9.6 -2023-10-04
CVE-2022-0358 QEMU 安全漏洞 — QEMU/virtiofsd 7.8 -2022-08-29
CVE-2021-37839 Apache Superset 访问控制错误漏洞 — Apache Superset 4.3 -2022-07-06
CVE-2021-3982 gnome-shell 安全漏洞 — gnome-shell 5.5 -2022-04-29
CVE-2021-36372 Apache Ozone 安全漏洞 — Apache Ozone 9.8 -2021-11-19

CWE-273（对于放弃特权的检查不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 12 条 CVE 漏洞。