CWE-287 认证机制不恰当 类弱点 1487 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-52968 | Fortinet FortiClient 授权问题漏洞 — FortiClientMac | 5.8 | Medium | 2025-02-11 |
| CVE-2025-1231 | Devolutions Server 安全漏洞 — Server | 8.8 | - | 2025-02-11 |
| CVE-2025-24032 | PAM-PKCS#11 授权问题漏洞 — pam_pkcs11 | 8.1 | - | 2025-02-10 |
| CVE-2025-0890 | Zyxel VMG4325-B10A 授权问题漏洞 — VMG4325-B10A firmware | 9.8 | Critical | 2025-02-04 |
| CVE-2024-12510 | Xerox Versalink 安全漏洞 — Versalink B400 | 6.7 | Medium | 2025-02-03 |
| CVE-2025-0637 | Microserver Beta10 授权问题漏洞 — Beta10 | 9.8 | Critical | 2025-01-23 |
| CVE-2025-0604 | Keycloak 授权问题漏洞 | 5.4 | Medium | 2025-01-22 |
| CVE-2024-36402 | Matrix 授权问题漏洞 — matrix-media-repo | 5.3 | Medium | 2025-01-16 |
| CVE-2025-22146 | Sentry 授权问题漏洞 — sentry | 9.1 | Critical | 2025-01-15 |
| CVE-2024-11322 | CyberPower PowerPanel Business 授权问题漏洞 — PowerPanel Business | 7.5 | High | 2025-01-15 |
| CVE-2024-12919 | WordPress plugin Paid Membership Subscriptions 授权问题漏洞 — Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | 9.8 | Critical | 2025-01-14 |
| CVE-2025-0070 | SAP NetWeaver Application Server和SAP ABAP Platform 授权问题漏洞 — SAP NetWeaver Application Server for ABAP and ABAP Platform | 9.9 | Critical | 2025-01-14 |
| CVE-2024-42172 | HCL DRYiCE MyXalytics 安全漏洞 — DRYiCE MyXalytics | 5.3 | Medium | 2025-01-11 |
| CVE-2024-9133 | Arista NG Firewall 安全漏洞 — Arista Edge Threat Management | 6.6 | Medium | 2025-01-10 |
| CVE-2024-13309 | Drupal 安全漏洞 — Login Disable | 8.2 | - | 2025-01-09 |
| CVE-2024-53704 | SonicWALL SSLVPN 安全漏洞 — SonicOS | 9.8 | - | 2025-01-09 |
| CVE-2024-56445 | Huawei HarmonyOS 授权问题漏洞 — HarmonyOS | 4.3 | Medium | 2025-01-08 |
| CVE-2024-12264 | WordPress plugin PayU CommercePro Plugin 授权问题漏洞 — PayU CommercePro Plugin | 9.8 | Critical | 2025-01-07 |
| CVE-2025-21618 | NiceGUI 授权问题漏洞 — nicegui | 7.5 | High | 2025-01-06 |
| CVE-2024-13111 | Yunfan Learning Examination System 安全漏洞 — Yunfan Learning Examination System | 5.6 | Medium | 2025-01-02 |
| CVE-2024-1609 | OPPO Store APP 安全漏洞 — OPPP Store | 8.8 | - | 2024-12-25 |
| CVE-2023-31279 | Sierra Wireless AirVantage 授权问题漏洞 — AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices. | 8.1 | High | 2024-12-20 |
| CVE-2024-56329 | Socialstream 授权问题漏洞 — socialstream | - | - | 2024-12-20 |
| CVE-2020-9250 | Micro Focus Vibe 跨站脚本漏洞 — HUAWEI Mate 20 Pro | 3.3 | Low | 2024-12-20 |
| CVE-2024-12287 | WordPress plugin Biagiotti Membership 授权问题漏洞 — Biagiotti Membership | 9.8 | Critical | 2024-12-18 |
| CVE-2024-1610 | OPPO Store app 安全漏洞 — OPPO Store APP | 8.8 | - | 2024-12-18 |
| CVE-2024-21543 | djoser 安全漏洞 — djoser | 7.1 | High | 2024-12-13 |
| CVE-2024-55886 | OpenSearch Data Prepper 授权问题漏洞 — data-prepper | 6.9 | Medium | 2024-12-12 |
| CVE-2024-10111 | WordPress plugin OAuth Single Sign On – SSO (OAuth Client) 授权问题漏洞 — OAuth Single Sign On – SSO (OAuth Client) | 8.1 | High | 2024-12-12 |
| CVE-2024-11015 | WordPress plugin Sign In With Google 授权问题漏洞 — Sign In With Google | 9.8 | Critical | 2024-12-12 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1487 条 CVE 漏洞。