目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-472 对假设不可变Web参数的外部可控制 类漏洞列表 133

CWE-472 对假设不可变Web参数的外部可控制 类弱点 133 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-472指外部控制假设不可变Web参数漏洞。攻击者常通过修改隐藏表单字段、Cookie或URL参数，篡改本应固定的关键数据。开发者应避免依赖客户端数据，对任何输入进行服务端严格验证，确保业务逻辑不受用户可控参数影响，从而防止数据被恶意修改。

MITRE CWE 官方描述
CWE：CWE-472 外部对假定不可变 Web 参数的控制 英文：Web 应用程序未充分验证那些被假定为不可变但实际上可受外部控制的输入，例如隐藏表单字段。 如果 Web 产品未能正确保护隐藏表单字段、参数、Cookie 或 URL 中假定不可变的值免受修改，则可能导致关键数据被篡改。Web 应用程序经常错误地假设通过隐藏字段或 Cookie 传递给客户端的数据不易被篡改。对用户可控制的数据进行不当验证可能导致应用程序处理不正确且通常是恶意的输入。例如，自定义 Cookie 通常存储会话数据或跨会话的持久数据。这类会话数据通常参与服务器端与安全相关的决策，例如用户身份验证和访问控制。因此，Cookie 可能包含敏感数据，如用户凭据和权限。这是一种危险的做法，因为它经常导致服务器端应用程序不当依赖客户端提供的 Cookie 的值。
常见影响 (1)
IntegrityModify Application Data
Without appropriate protection mechanisms, the client can easily tamper with cookies and similar web data. Reliance on the cookies without detailed validation can lead to problems such as SQL injection. If you use cookie values for security related decisions on the server side, manipulating the cook…
缓解措施 (2)
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
代码示例 (2)
In this example, a web application uses the value of a hidden form field (accountID) without having done any input validation because it was assumed to be immutable.
String accountID = request.getParameter("accountID"); User user = getUserFromID(Long.parseLong(accountID));
Bad · Java
Hidden fields should not be trusted as secure parameters.
<input type="hidden"
Bad · HTML
CVE ID标题CVSS风险等级Published
CVE-2025-7656 Google Chrome 安全漏洞 — Chrome 8.8 -2025-07-15
CVE-2025-6191 Google chrome 安全漏洞 — Chrome 8.8AIHighAI2025-06-18
CVE-2025-43002 SAP S4CORE 安全漏洞 — SAP S4/HANA (OData meta-data property) 4.3 Medium2025-05-13
CVE-2025-47817 Checkmate 安全漏洞 — Checkmate 8.8 High2025-05-10
CVE-2025-35939 Craft CMS 安全漏洞 — CMS 5.3 Medium2025-05-07
CVE-2025-47245 Checkmate 安全漏洞 — Checkmate 8.1 High2025-05-03
CVE-2025-3743 WordPress plugin Upsell Funnel Builder for WooCommerce 安全漏洞 — Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. 5.3 Medium2025-04-25
CVE-2025-3530 WordPress plugin Simple Shopping Cart 安全漏洞 — Simple Shopping Cart 7.5 High2025-04-23
CVE-2025-31327 SAP Field Logistics Manage Logistics 安全漏洞 — SAP Field Logistics 4.3 Medium2025-04-22
CVE-2025-32816 CourseLit 安全漏洞 — CourseLit 3.1 Low2025-04-11
CVE-2025-31333 SAP S4CORE 安全漏洞 — SAP S4CORE entity 4.3 Medium2025-04-08
CVE-2025-30152 PayPal Plugin 安全漏洞 — PayPalPlugin 6.5 Medium2025-03-19
CVE-2025-30236 Shearwater SecurEnvoy SecurAccess Enrol 安全漏洞 — SecurAccess 8.6 High2025-03-19
CVE-2025-29788 PayPal Plugin 安全漏洞 — PayPalPlugin 6.5 Medium2025-03-17
CVE-2025-26312 SendQuick Entera 安全漏洞 — Entera 9.1 -2025-03-14
CVE-2025-27893 Archer Platform 安全漏洞 — Archer 1.8 Low2025-03-11
CVE-2025-0436 Google Chrome 安全漏洞 — Chrome 8.8 -2025-01-15
CVE-2025-22384 Optimizely Configured Commerce 安全漏洞 — n/a 5.3 -2025-01-04
CVE-2024-50703 TeamPass 安全漏洞 — TeamPass 5.4 Medium2024-12-30
CVE-2024-12123 Issuetrak 安全漏洞 — Issuetrak 4.3 -2024-12-04
CVE-2024-7025 Microsoft Edge 安全漏洞 — Chrome 8.8 -2024-11-27
CVE-2024-9123 Google Chrome 安全漏洞 — Chrome 8.8AIHighAI2024-09-24
CVE-2024-6010 WordPress plugin Cost Calculator Builder PRO 安全漏洞 — Cost Calculator Builder PRO 5.3 Medium2024-09-07
CVE-2023-38520 WordPress plugin Pinpoint Booking System 安全漏洞 — Pinpoint Booking System 6.5 Medium2024-06-04
CVE-2023-24373 WordPress plugin Booking calendar, Appointment Booking System 安全漏洞 — Booking calendar, Appointment Booking System 3.7 Low2024-06-03
CVE-2024-3649 WordPress plugin Contact Form by WPForms 安全漏洞 — WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More 5.3 Medium2024-05-02
CVE-2024-25153 FileCatalyst Workflow Web Portal 安全漏洞 — FileCatalyst 9.8 Critical2024-03-13
CVE-2023-28512 IBM Watson CP4D Data Stores 安全漏洞 — Watson CP4D Data Stores 5.9 Medium2024-03-03
CVE-2024-22049 httparty 安全漏洞 6.5AIMediumAI2024-01-04
CVE-2022-30597 Moodle 安全漏洞 — moodle 5.3 -2022-05-18

CWE-472（对假设不可变Web参数的外部可控制） 是常见的弱点类别，本平台收录该类弱点关联的 133 条 CVE 漏洞。