目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-807 在安全决策中依赖未经信任的输入 类漏洞列表 58

CWE-807 在安全决策中依赖未经信任的输入 类弱点 58 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-807 属于依赖不可信输入进行安全决策的漏洞。攻击者通过篡改 Cookie、环境变量或隐藏表单字段等输入，绕过产品依赖这些值建立的保护机制。开发者需摒弃对客户端数据的盲目信任，不应假设此类输入不可修改。在关键安全逻辑中，必须对输入进行严格验证、完整性校验及服务端重新计算，确保决策依据不被恶意操纵，从而防止安全控制失效。

MITRE CWE 官方描述
CWE：CWE-807 在安全决策中依赖不可信输入 英文：产品使用了一种保护机制，该机制依赖于某个输入的存在性或值，但该输入可以被不可信的行为者以绕过该保护机制的方式进行修改。 开发人员可能假设诸如 cookies、环境变量和隐藏表单字段等输入无法被修改。然而，攻击者可以使用定制的客户端或其他攻击手段来更改这些输入。这种更改可能不会被检测到。当基于这些输入的值进行身份验证（authentication）和授权（authorization）等安全决策时，攻击者可以绕过软件的安全性。如果没有足够的加密（encryption）、完整性检查（integrity checking）或其他机制，任何源自外部的输入都不可信。
常见影响 (1)
Confidentiality, Access Control, Availability, OtherBypass Protection Mechanism, Gain Privileges or Assume Identity, Varies by Context
Attackers can bypass the security decision to access whatever is being protected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to expo…
缓解措施 (5)
Architecture and DesignStore state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the cli…
Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since …
Architecture and DesignFor any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Operation, ImplementationWhen using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
Architecture and Design, ImplementationUnderstand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly throug…
代码示例 (2)
The following code excerpt reads a value from a browser cookie to determine the role of the user.
Cookie[] cookies = request.getCookies(); for (int i =0; i< cookies.length; i++) { Cookie c = cookies[i]; if (c.getName().equals("role")) { userRole = c.getValue(); } }
Bad · Java
The following code could be for a medical records application. It performs authentication by checking if a cookie has been set.
$auth = $_COOKIES['authenticated']; if (! $auth) { if (AuthenticateUser($_POST['user'], $_POST['password']) == "success") { // save the cookie to send out in future responses setcookie("authenticated", "1", time()+60*60*2); } else { ShowLoginScreen(); die("\n"); } } DisplayMedicalHistory($_POST['patient_ID']);
Bad · PHP
CVE ID标题CVSS风险等级Published
CVE-2026-6213 Apache Spark SparkView 远程代码执行漏洞 — SparkView--2026-05-08
CVE-2026-39807 bandit 未验证传输安全的 URI 方案漏洞 — bandit 7.5AIHighAI2026-05-01
CVE-2026-41403 OpenClaw 安全漏洞 — OpenClaw 2.9 Low2026-04-28
CVE-2026-41390 OpenClaw 安全漏洞 — OpenClaw 7.3 High2026-04-28
CVE-2026-41380 OpenClaw 安全漏洞 — OpenClaw 7.3 High2026-04-28
CVE-2026-1789 Canon多款产品 安全漏洞 — imagePRESS Series 4.9 Medium2026-04-23
CVE-2026-41299 OpenClaw 安全漏洞 — OpenClaw 7.1 High2026-04-20
CVE-2026-0390 Microsoft Windows 安全漏洞 — Windows 10 Version 1607 6.7 Medium2026-04-14
CVE-2019-25711 Nsasoft SpotFTP Password Recover 安全漏洞 — SpotFTP Password Recover 6.2 Medium2026-04-12
CVE-2026-35670 OpenClaw 安全漏洞 — OpenClaw 5.9 Medium2026-04-10
CVE-2026-35655 OpenClaw 安全漏洞 — OpenClaw 5.7 Medium2026-04-10
CVE-2026-35624 OpenClaw 安全漏洞 — OpenClaw 4.2 Medium2026-04-09
CVE-2026-35617 OpenClaw 安全漏洞 — OpenClaw 4.2 Medium2026-04-09
CVE-2025-13926 Contemporary Controls BASControl20 安全漏洞 — BASControl20 9.8 Critical2026-04-09
CVE-2026-29134 SEPPmail Secure Email Gateway 安全漏洞 — Secure Email Gateway 5.3AIMediumAI2026-04-02
CVE-2026-32975 OpenClaw 安全漏洞 — OpenClaw 9.8 Critical2026-03-29
CVE-2019-25621 Pixarra Pixel Studio 安全漏洞 — Pixel Studio 6.2 Medium2026-03-23
CVE-2019-25594 Xlinesoft ASPRunner.NET 安全漏洞 — ASPRunner.NET 6.2 Medium2026-03-22
CVE-2019-25544 Pidgin 安全漏洞 — Pidgin 6.2 Medium2026-03-21
CVE-2026-32898 OpenClaw 安全漏洞 — OpenClaw 5.4 Medium2026-03-21
CVE-2026-32057 OpenClaw 安全漏洞 — OpenClaw 7.1 High2026-03-21
CVE-2026-29794 Vikunja 安全漏洞 — vikunja 5.3 Medium2026-03-20
CVE-2026-33068 Claude Code 安全漏洞 — claude-code 8.8 -2026-03-20
CVE-2026-21514 Microsoft Word 安全漏洞 — Microsoft 365 Apps for Enterprise 7.8 High2026-02-10
CVE-2026-25958 Cube 安全漏洞 — cube 7.7 High2026-02-09
CVE-2026-21509 Microsoft Office 安全漏洞 — Microsoft 365 Apps for Enterprise 7.8 High2026-01-26
CVE-2026-23848 MyTube 安全漏洞 — MyTube 6.5 Medium2026-01-19
CVE-2026-20849 Microsoft Windows Kerberos 安全漏洞 — Windows 10 Version 1607 7.5 High2026-01-13
CVE-2025-12487 Text Generation Web UI 安全漏洞 — text-generation-webui 9.8 -2025-11-06
CVE-2025-12488 Text Generation Web UI 安全漏洞 — text-generation-webui 9.8 -2025-11-06

CWE-807（在安全决策中依赖未经信任的输入） 是常见的弱点类别，本平台收录该类弱点关联的 58 条 CVE 漏洞。