CWE-257 以可恢复格式存储口令 类弱点 63 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-257指以可恢复格式存储密码的漏洞，属于数据保护缺陷。攻击者或恶意内部人员可利用系统管理员的恢复权限，直接获取明文密码，从而实施凭证重用攻击，危害远超普通明文存储。开发者应避免实现密码恢复功能，改为强制重置机制，并使用不可逆的单向哈希算法加盐存储密码，确保即使数据库泄露，攻击者也无法还原原始凭证。
int VerifyAdmin(char *password) { if (strcmp(compress(password), compressed_password)) { printf("Incorrect Password!\n"); return(0); } printf("Entering Diagnostic Mode...\n"); return(1); }int VerifyAdmin(String password) { if (passwd.Equals(compress(password), compressed_password)) { return(0); } //Diagnostic Mode return(1); }# Java Web App ResourceBundle properties file ... webapp.ldap.username=secretUsername webapp.ldap.password=secretPassword ...... <connectionStrings> <add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" /> </connectionStrings> ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-45744 | TopQuadrant TopBraid EDG 安全漏洞 — TopBraid EDG | 3.0 | Low | 2024-09-27 |
| CVE-2024-6694 | WordPress plugin WP Mail SMTP 安全漏洞 — WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin | 2.7 | Low | 2024-07-20 |
| CVE-2024-32932 | Johnson Controls Illustra Essentials Gen 4 安全漏洞 — American Dynamics Illustra Essentials Gen 4 | 6.8 | Medium | 2024-07-02 |
| CVE-2024-32756 | Johnson Controls Illustra Essentials Gen 4 安全漏洞 — American Dynamics Illustra Essentials Gen 4 | 6.8 | Medium | 2024-07-02 |
| CVE-2024-3073 | WordPress plugin Easy WP SMTP by SendLayer 安全漏洞 — Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more | 2.7 | Low | 2024-06-13 |
| CVE-2024-32042 | Cyber Power Systems PowerPanel Business Edition 安全漏洞 — PowerPanel business | 4.9 | Medium | 2024-05-15 |
| CVE-2024-3543 | DELL ECS Connection Manager 安全漏洞 — LoadMaster | 6.4 | Medium | 2024-05-02 |
| CVE-2024-1480 | Unitronics Vision series PLCs 安全漏洞 — Vision230 | 7.5 | High | 2024-04-19 |
| CVE-2023-38738 | IBM OpenPages with Watson 安全漏洞 — OpenPages with Watson | 6.8 | Medium | 2024-01-19 |
| CVE-2023-31001 | IBM Security Access Manager Appliance 安全漏洞 — Security Verify Access Appliance | 5.1 | Medium | 2024-01-11 |
| CVE-2023-2358 | Hitachi Vantara Pentaho Business Analytics Server 安全漏洞 — Pentaho Business Analytics Server | 4.3 | Medium | 2023-09-26 |
| CVE-2022-47376 | BD Alaris Infusion Central 安全漏洞 — Alaris Infusion Central | 7.5 | - | 2023-06-13 |
| CVE-2023-2881 | Pimcore 安全漏洞 — pimcore/customer-data-framework | 6.5 | - | 2023-05-25 |
| CVE-2023-31150 | Schweitzer Engineering Laboratories Real Time Automation Controller 安全漏洞 — SEL-3505 | 8.0 | High | 2023-05-10 |
| CVE-2023-23382 | Microsoft Azure Machine Learning 安全漏洞 — Azure Machine Learning | 6.5 | Medium | 2023-02-14 |
| CVE-2022-32519 | Schneider Electric StruxureWare Data Center Expert 安全漏洞 — Data Center Expert | 8.0 | High | 2023-01-30 |
| CVE-2023-21726 | Microsoft Windows 安全漏洞 — Windows 10 Version 1809 | 7.8 | High | 2023-01-10 |
| CVE-2022-46142 | Siemens部分产品 安全漏洞 — RUGGEDCOM RM1224 LTE(4G) EU | 5.7 | Medium | 2022-12-13 |
| CVE-2022-22251 | Juniper Networks Junos OS 安全漏洞 — Junos OS | 7.8 | High | 2022-10-18 |
| CVE-2022-34838 | ABB Zenon 安全漏洞 — ABB Zenon | 8.1 | High | 2022-08-24 |
| CVE-2022-34837 | ABB Zenon 安全漏洞 — ABB Zenon | 6.2 | Medium | 2022-08-24 |
| CVE-2021-35050 | Fidelis Network 安全漏洞 — Fidelis Network | 6.5 | Medium | 2021-06-25 |
| CVE-2021-27485 | ZOLL Defibrillator Dashboard 安全漏洞 — ZOLL Defibrillator Dashboard | 6.5 | - | 2021-06-16 |
| CVE-2020-8296 | Nextcloud 安全漏洞 — Nextcloud Server | 6.5 | - | 2021-03-03 |
| CVE-2021-0220 | Juniper Networks Junos OS 安全漏洞 — Junos Space | 6.8 | Medium | 2021-01-15 |
| CVE-2019-18256 | Biotronik CardioMessenger II-S 授权问题漏洞 — BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S GSM | 4.6 | - | 2020-06-29 |
| CVE-2019-19096 | ABB eSOMS 安全漏洞 — eSOMS | 6.1 | Medium | 2020-04-02 |
| CVE-2019-3736 | Dell EMC Integrated Data Protection Appliance ACM组件安全漏洞 — Integrated Data Protection Appliance | 9.1 | - | 2019-09-27 |
| CVE-2019-1010241 | CloudBees Jenkins Credentials Binding Plugin Jenkins插件信任管理问题漏洞 — Jenkins | 6.5 | - | 2019-07-19 |
| CVE-2019-6567 | Siemens Scalance X-300 信任管理问题漏洞 — SCALANCE X-200 switch family (incl. SIPLUS NET variants) | 9.1 | - | 2019-06-12 |
CWE-257（以可恢复格式存储口令） 是常见的弱点类别，本平台收录该类弱点关联的 63 条 CVE 漏洞。