目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1390 类漏洞列表 96

CWE-1390 类弱点 96 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1390 属于弱认证漏洞，指产品使用的认证机制无法充分验证用户身份的真实性。攻击者通常利用此缺陷，以较低成本或更快速度绕过身份验证，从而非法获取系统访问权限。开发者应避免使用默认凭证、简单密码或易被破解的算法，转而实施多因素认证、强密码策略及定期密钥轮换，确保身份验证过程具备足够的抗攻击能力。

MITRE CWE 官方描述
CWE：CWE-1390 Weak Authentication（弱认证） 英文：The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct. 译文：该产品使用一种认证机制来限制对特定用户或身份的访问，但该机制未能充分证明所声称的身份是正确的。 Attackers may be able to bypass weak authentication faster and/or with less effort than expected. 译文：攻击者可能能够比预期更快地和/或更轻松地绕过弱认证。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
代码示例 (1)
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID 标题 CVSS 风险等级 Published
CVE-2024-0822 Red Hat oVirt 安全漏洞 7.5 High 2024-01-25
CVE-2023-4094 Fujitsu Arconte Áurea 授权问题漏洞 — Arconte Áurea 6.5 Medium 2023-09-19
CVE-2023-41900 Eclipse Jetty 安全漏洞 — jetty.project 3.5 Low 2023-09-15
CVE-2022-45860 Fortinet FortiNAC 授权问题漏洞 — FortiNAC 5.0 Medium 2023-05-03
CVE-2023-24890 Microsoft OneDrive 安全漏洞 — OneDrive for iOS 6.5 Medium 2023-03-14
CVE-2022-43400 Siemens Siveillance Video Mobile Server 授权问题漏洞 — Siveillance Video Mobile Server V2022 R2 9.8 - 2022-10-21

CWE-1390 是常见的弱点类别，本平台收录该类弱点关联的 96 条 CVE 漏洞。