CWE-287 认证机制不恰当 类弱点 1487 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-2859 | Arteche saTECH BCU 授权问题漏洞 — saTECH BCU | 7.1 | - | 2025-03-28 |
| CVE-2025-30361 | WeGIA 授权问题漏洞 — WeGIA | 9.1AI | Critical AI | 2025-03-27 |
| CVE-2025-30168 | parse-server 授权问题漏洞 — parse-server | 6.9 | Medium | 2025-03-21 |
| CVE-2025-26475 | Dell Secure Connect Gateway（Dell SCG） 授权问题漏洞 — Secure Connect Gateway (SCG) 5.0 Appliance - SRS | 5.5 | Medium | 2025-03-19 |
| CVE-2025-2388 | Keytop On-street parking payment system 授权问题漏洞 — 路内停车收费系统 | 7.3 | High | 2025-03-17 |
| CVE-2025-2339 | Tale Blog 授权问题漏洞 — Tale Blog | 5.3 | Medium | 2025-03-16 |
| CVE-2025-2230 | Philips IntelliSpace Perinatal 授权问题漏洞 — Intellispace Cardiovascular (ISCV) | 7.7 | High | 2025-03-13 |
| CVE-2025-29773 | Froxlor 安全漏洞 — Froxlor | 5.8 | Medium | 2025-03-13 |
| CVE-2025-27138 | DataEase 授权问题漏洞 — dataease | 9.1 | - | 2025-03-13 |
| CVE-2025-0813 | Schneider Electric EcoStruxure Power Automation System User Interface 授权问题漏洞 — EcoStruxure Power Automation System User Interface (EPAS-UI) - Secured Versions | 6.8 | Medium | 2025-03-12 |
| CVE-2025-27403 | Ratify 授权问题漏洞 — ratify | 7.1 | - | 2025-03-11 |
| CVE-2024-56336 | Siemens SINAMICS S200 授权问题漏洞 — SINAMICS S200 | 9.8 | Critical | 2025-03-11 |
| CVE-2024-11087 | WordPress plugin miniOrange Social Login and Register 授权问题漏洞 — miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) | 8.1 | High | 2025-03-08 |
| CVE-2025-1475 | WordPress plugin WPCOM Member 授权问题漏洞 — WPCOM Member | 9.8 | Critical | 2025-03-07 |
| CVE-2025-27422 | Faction 授权问题漏洞 — faction | 7.5 | High | 2025-03-03 |
| CVE-2024-38426 | Qualcomm Chipsets 授权问题漏洞 — Snapdragon | 5.4 | Medium | 2025-03-03 |
| CVE-2025-1723 | ZOHO ManageEngine ADSelfService Plus 授权问题漏洞 — ADSelfService Plus | 8.1 | High | 2025-03-03 |
| CVE-2025-27416 | Scratch Coding Hut 授权问题漏洞 — Scratch-Coding-Hut.github.io | 9.8 | - | 2025-03-01 |
| CVE-2025-27414 | MinIO 授权问题漏洞 — minio | 7.4 | - | 2025-02-28 |
| CVE-2025-27112 | Navidrome 授权问题漏洞 — navidrome | 9.1 | - | 2025-02-24 |
| CVE-2024-5174 | Perforce Gliffy 安全漏洞 — Gliffy Online | 6.8 | - | 2025-02-24 |
| CVE-2025-1024 | ChurchCRM 安全漏洞 — ChurchCRM | 4.8 | - | 2025-02-19 |
| CVE-2025-24895 | AspNetCore Remote Authenticator for CIE3.0 授权问题漏洞 — cie-aspnetcore | 9.1 | Critical | 2025-02-18 |
| CVE-2025-24894 | AspNetCore Remote Authenticator for SPID 授权问题漏洞 — spid-aspnetcore | 9.1 | Critical | 2025-02-18 |
| CVE-2025-0981 | ChurchCRM 安全漏洞 — ChurchCRM | 4.8 | - | 2025-02-18 |
| CVE-2025-24904 | libsignal-service-rs 注入漏洞 — libsignal-service-rs | 8.5 | High | 2025-02-13 |
| CVE-2025-25201 | Nitrokey 3 Firmware 授权问题漏洞 — nitrokey-3-firmware | 4.0 | Medium | 2025-02-12 |
| CVE-2024-13528 | WordPress plugin Customer Email Verification for WooCommerce 授权问题漏洞 — Customer Email Verification for WooCommerce | 7.5 | High | 2025-02-12 |
| CVE-2025-1044 | Logsign Unified SecOps Platform 授权问题漏洞 — Unified SecOps Platform | 9.8 | - | 2025-02-11 |
| CVE-2025-21349 | Microsoft Windows Remote Desktop Services 授权问题漏洞 — Windows 10 Version 1507 | 6.8 | Medium | 2025-02-11 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1487 条 CVE 漏洞。