CWE-287 认证机制不恰当 类弱点 1488 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-4978 | NETGEAR DGND3700 安全漏洞 — DGND3700 | 9.8 | Critical | 2025-05-20 |
| CVE-2025-47790 | Nextcloud 授权问题漏洞 — security-advisories | 6.4 | Medium | 2025-05-16 |
| CVE-2025-4755 | D-Link DI-7003G 授权问题漏洞 — DI-7003GV2 | 7.3 | High | 2025-05-16 |
| CVE-2025-47275 | Auth0-PHP 授权问题漏洞 — auth0-PHP | 9.1 | Critical | 2025-05-15 |
| CVE-2025-26685 | Microsoft Defender 授权问题漏洞 — Microsoft Defender for Identity | 6.5 | Medium | 2025-05-13 |
| CVE-2025-3659 | Digi多款产品 安全漏洞 — Digi PortServer TS | 9.8AI | Critical AI | 2025-05-12 |
| CVE-2025-4494 | JAdmin 授权问题漏洞 — JAdmin | 7.3 | High | 2025-05-09 |
| CVE-2024-11186 | Arista Networks CloudVision Portal 安全漏洞 — CloudVision Portal | 10.0 | Critical | 2025-05-08 |
| CVE-2025-46573 | Passport-wsfed-saml2 安全漏洞 — passport-wsfed-saml2 | 7.4AI | High AI | 2025-05-06 |
| CVE-2025-46572 | Passport-wsfed-saml2 安全漏洞 — passport-wsfed-saml2 | 7.4AI | High AI | 2025-05-06 |
| CVE-2025-22477 | Dell Storage Manager 授权问题漏洞 — Dell Storage Center - Dell Storage Manager | 8.3 | High | 2025-05-06 |
| CVE-2025-46590 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 6.3 | Medium | 2025-05-06 |
| CVE-2025-0217 | BeyondTrust Privileged Remote Access 安全漏洞 — Privileged Remote Access | 5.5AI | Medium AI | 2025-05-05 |
| CVE-2025-4144 | workers-oauth-provider 安全漏洞 | 5.3AI | Medium AI | 2025-05-01 |
| CVE-2025-29906 | finit 授权问题漏洞 — finit | 8.6 | High | 2025-04-29 |
| CVE-2025-3910 | Keycloak 安全漏洞 | 5.4 | Medium | 2025-04-29 |
| CVE-2025-46348 | YesWiki 安全漏洞 — yeswiki | 10.0 | Critical | 2025-04-29 |
| CVE-2025-3627 | Moodle 授权问题漏洞 | 4.3 | Medium | 2025-04-25 |
| CVE-2025-3634 | Moodle 授权问题漏洞 | 4.3 | Medium | 2025-04-25 |
| CVE-2024-11917 | WordPress plugin JobSearch WP Job Board 授权问题漏洞 — JobSearch WP Job Board | 8.1 | High | 2025-04-25 |
| CVE-2025-2771 | BEC Routers 授权问题漏洞 — Multiple Routers | 9.8 | - | 2025-04-23 |
| CVE-2025-3850 | SpringBoot-Vue-OnlineExam 授权问题漏洞 — SpringBoot-Vue-OnlineExam | 3.7 | Low | 2025-04-22 |
| CVE-2025-31478 | Zulip 授权问题漏洞 — zulip | 8.2 | High | 2025-04-16 |
| CVE-2025-2572 | Progress Software WhatsUp Gold 授权问题漏洞 — WhatsUp Gold | 5.6 | Medium | 2025-04-14 |
| CVE-2025-22232 | VMware Spring Cloud Config 安全漏洞 — Spring Cloud Config | 5.3 | Medium | 2025-04-10 |
| CVE-2025-22375 | Videx CyberAudit-Web 安全漏洞 — CyberAudit-Web | 9.1AI | Critical AI | 2025-04-10 |
| CVE-2025-30287 | Adobe ColdFusion 授权问题漏洞 — ColdFusion | 8.2 | High | 2025-04-08 |
| CVE-2025-30282 | Adobe ColdFusion 授权问题漏洞 — ColdFusion | 9.1 | Critical | 2025-04-08 |
| CVE-2025-25227 | Joomla! 授权问题漏洞 — Joomla! CMS | 8.1 | - | 2025-04-08 |
| CVE-2025-3268 | TinyWebServer 授权问题漏洞 — TinyWebServer | 5.3 | Medium | 2025-04-04 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1488 条 CVE 漏洞。