CWE-863 授权机制不正确 类弱点 1772 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-863属于授权检查缺陷，指系统在验证用户访问权限时未能正确执行检查逻辑。攻击者通常利用此漏洞，通过构造恶意请求或篡改参数，绕过权限控制以访问未授权资源或执行敏感操作。开发者应避免此问题，需确保在关键操作前严格验证用户身份与权限，采用最小权限原则，并实施集中式的授权管理，防止逻辑绕过或硬编码错误。
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-39388 | Istio 安全漏洞 — istio | 7.6 | High | 2022-11-10 |
| CVE-2022-39352 | OpenFGA 安全漏洞 — openfga | 4.8 | Medium | 2022-11-08 |
| CVE-2022-42344 | Adobe Commerce 输入验证错误漏洞 — Adobe Commerce | 8.8 | High | 2022-10-20 |
| CVE-2022-3582 | Simple Cold Storage Management System 跨站请求伪造漏洞 — Simple Cold Storage Management System | 4.3 | Medium | 2022-10-18 |
| CVE-2022-3585 | Simple Cold Storage Management System 安全漏洞 — Simple Cold Storage Management System | 4.3 | Medium | 2022-10-18 |
| CVE-2022-39302 | Ree6 安全漏洞 — Ree6 | 5.5 | Medium | 2022-10-13 |
| CVE-2022-31252 | openSUSE 安全漏洞 — SUSE Linux Enterprise Server 12-SP5 | 4.4 | Medium | 2022-10-06 |
| CVE-2022-39275 | saleor 输入验证错误漏洞 — saleor | 5.3 | Medium | 2022-10-06 |
| CVE-2022-3024 | WordPress plugin Simple Bitcoin Faucets 安全漏洞 — Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi Games, Referral Program | 7.6 | - | 2022-09-26 |
| CVE-2022-39955 | OWASP ModSecurity Core Rule Set 安全漏洞 — ModSecurity Core Rule Set | 7.3 | High | 2022-09-20 |
| CVE-2022-39956 | OWASP ModSecurity Core Rule Set 安全漏洞 — ModSecurity Core Rule Set | 7.3 | High | 2022-09-20 |
| CVE-2022-39958 | OWASP ModSecurity Core Rule Set 安全漏洞 — ModSecurity Core Rule Set | 7.5 | High | 2022-09-20 |
| CVE-2022-36109 | Moby 安全漏洞 — moby | 5.3 | Medium | 2022-09-09 |
| CVE-2022-23451 | barbican 授权问题漏洞 — openstack/barbican | 8.1 | - | 2022-09-06 |
| CVE-2022-2597 | WordPress plugin Visual Portfolio 安全漏洞 — Visual Portfolio, Photo Gallery & Post Grid | 5.4 | - | 2022-09-05 |
| CVE-2022-23452 | barbican 授权问题漏洞 — openstack/barbican | 4.9 | - | 2022-09-01 |
| CVE-2021-3563 | Red Hat OpenStack Platform 安全漏洞 — keystone | 7.4 | - | 2022-08-26 |
| CVE-2021-3763 | AMQ 访问控制错误漏洞 — AMQ Broker | 4.3 | - | 2022-08-23 |
| CVE-2022-35692 | Adobe Commerce 安全漏洞 — Magento Commerce | 5.3 | Medium | 2022-08-19 |
| CVE-2022-36009 | gomatrixserverlib 安全漏洞 — gomatrixserverlib | 5.0 | Medium | 2022-08-19 |
| CVE-2022-1401 | Device42 访问控制错误漏洞 — CMDB | 6.9 | Medium | 2022-08-16 |
| CVE-2020-14321 | Moodle 权限许可和访问控制问题漏洞 — Moodle | 8.8 | - | 2022-08-16 |
| CVE-2022-33718 | SAMSUNG Mobile devices 安全漏洞 — Samsung Mobile Devices | 6.2 | Medium | 2022-08-05 |
| CVE-2022-27551 | HCL Technologies HCL Launch 安全漏洞 — HCL Launch | 5.3 | Medium | 2022-08-03 |
| CVE-2022-31178 | eLabFTW 安全漏洞 — elabftw | 4.3 | Medium | 2022-08-01 |
| CVE-2022-31155 | Sourcegraph 安全漏洞 — sourcegraph | 4.3 | Medium | 2022-08-01 |
| CVE-2022-31154 | Sourcegraph 安全漏洞 — sourcegraph | 6.4 | Medium | 2022-08-01 |
| CVE-2022-0670 | Red Hat Ceph 安全漏洞 — Ceph | 8.1 | - | 2022-07-25 |
| CVE-2022-0594 | WordPress plugin Shareaholic 信息泄露漏洞 — Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic | 5.3 | - | 2022-07-25 |
| CVE-2022-31107 | Grafana 授权问题漏洞 — grafana | 7.1 | High | 2022-07-15 |
CWE-863（授权机制不正确） 是常见的弱点类别，本平台收录该类弱点关联的 1772 条 CVE 漏洞。