CWE-287 认证机制不恰当 类弱点 1487 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-45404 | OpenCTI 安全漏洞 — opencti | 8.1 | High | 2024-12-11 |
| CVE-2024-47761 | GLPI 授权问题漏洞 — glpi | 7.2 | - | 2024-12-11 |
| CVE-2024-10511 | Schneider Electric PowerChute Serial Shutdown 授权问题漏洞 — PowerChute Serial Shutdown | 5.3 | Medium | 2024-12-11 |
| CVE-2024-49076 | Microsoft Windows Virtualization-Based Security Enclave 授权问题漏洞 — Windows 10 Version 1809 | 7.8 | High | 2024-12-10 |
| CVE-2024-0130 | NVIDIA UFM 授权问题漏洞 — UFM Enterprise GA | 8.8 | High | 2024-12-06 |
| CVE-2024-48859 | QNAP Systems QTS和QuTS hero 安全漏洞 — QTS | 9.8 | - | 2024-12-06 |
| CVE-2024-11293 | WordPress plugin Registration Forms 安全漏洞 — Pie Register - Social Sites Login (Add on) | 8.1 | High | 2024-12-04 |
| CVE-2024-45106 | Apache Ozone 安全漏洞 — Apache Ozone | 6.8 | - | 2024-12-03 |
| CVE-2024-53990 | Async Http Client 授权问题漏洞 — async-http-client | 8.2 | - | 2024-12-02 |
| CVE-2018-11952 | Qualcomm Chipsets 授权问题漏洞 — Snapdragon | 7.8 | High | 2024-11-26 |
| CVE-2016-10394 | Qualcomm Chipsets 授权问题漏洞 — Snapdragon | 9.8 | High | 2024-11-26 |
| CVE-2024-11671 | Devolutions Remote Desktop Manager 安全漏洞 — Remote Desktop Manager | 8.8AI | High AI | 2024-11-25 |
| CVE-2022-33862 | Eaton IPP 安全漏洞 — Intelligent Power Protector (IPP) | 6.7 | Medium | 2024-11-25 |
| CVE-2024-45369 | mySCADA myPRO 授权问题漏洞 — myPRO Manager | 8.1 | High | 2024-11-22 |
| CVE-2024-6248 | Wyze Cam 授权问题漏洞 — Cam v3 | 8.8 | - | 2024-11-22 |
| CVE-2024-11494 | Zyxel P-6101C 授权问题漏洞 — P-6101C firmware | 7.5 | High | 2024-11-20 |
| CVE-2024-47533 | Cobbler 授权问题漏洞 — cobbler | 9.8 | Critical | 2024-11-18 |
| CVE-2024-52518 | Nextcloud 授权问题漏洞 — security-advisories | 4.4 | Medium | 2024-11-15 |
| CVE-2024-11209 | Apereo CAS 授权问题漏洞 — CAS | 6.3 | Medium | 2024-11-14 |
| CVE-2024-51996 | Symphony Communication ServicesHp Symphony 安全漏洞 — symfony | 7.5 | High | 2024-11-13 |
| CVE-2024-49039 | Microsoft Windows Task Scheduler 授权问题漏洞 — Windows Server 2025 | 8.8 | High | 2024-11-12 |
| CVE-2024-51997 | trustee 授权问题漏洞 — trustee | 8.1 | High | 2024-11-08 |
| CVE-2024-10963 | Red Hat Enterprise Linux 7 授权问题漏洞 | 7.4 | High | 2024-11-07 |
| CVE-2024-50341 | Symfony 安全漏洞 — symfony | 3.1 | Low | 2024-11-06 |
| CVE-2024-9946 | WordPress plugin Super Socializer 授权问题漏洞 — Social Share, Social Login and Social Comments Plugin – Super Socializer | 8.1 | High | 2024-11-06 |
| CVE-2024-10020 | WordPress plugin Heateor Social Login WordPress 安全漏洞 — Heateor Social Login WordPress | 8.1 | High | 2024-11-06 |
| CVE-2023-29117 | Enel X Waybox 安全漏洞 — JuiceBox Pro 3.0 22kW Cellular | 8.8 | High | 2024-11-05 |
| CVE-2024-10114 | WordPress plugin Social Login 授权问题漏洞 — WooCommerce - Social Login | 8.1 | High | 2024-11-05 |
| CVE-2024-10097 | WordPress plugin Loginizer Security and Loginizer 授权问题漏洞 — Loginizer Security | 8.1 | High | 2024-11-05 |
| CVE-2024-10620 | Disconf 安全漏洞 — Disconf | 5.3 | Medium | 2024-11-01 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1487 条 CVE 漏洞。