CWE-287 认证机制不恰当 类弱点 1486 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-5805 | Progress Software MOVEit 安全漏洞 — MOVEit Gateway | 9.1 | Critical | 2024-06-25 |
| CVE-2024-37233 | WordPress plugin 授权问题漏洞 — Play.ht | 4.3 | Medium | 2024-06-24 |
| CVE-2024-37897 | SFTPGo 安全漏洞 — sftpgo | 5.4 | Medium | 2024-06-20 |
| CVE-2024-38351 | PocketBase 安全漏洞 — pocketbase | 5.4 | Medium | 2024-06-18 |
| CVE-2024-37893 | Firefly III 安全漏洞 — firefly-iii | 5.9 | Medium | 2024-06-17 |
| CVE-2024-37313 | Nextcloud 安全漏洞 — security-advisories | 7.3 | High | 2024-06-14 |
| CVE-2024-37368 | Rockwell Automation FactoryTalk View SE 安全漏洞 — FactoryTalk® View SE | 5.3AI | Medium AI | 2024-06-14 |
| CVE-2024-37367 | Rockwell Automation FactoryTalk View SE 安全漏洞 — FactoryTalk® View SE | 5.3AI | Medium AI | 2024-06-14 |
| CVE-2024-3080 | ASUS Router 授权问题漏洞 — ZenWiFi XT8 | 9.8 | Critical | 2024-06-14 |
| CVE-2024-30299 | Adobe Framemaker 授权问题漏洞 — Adobe Framemaker Publishing Server | 10.0 | Critical | 2024-06-13 |
| CVE-2024-34103 | Adobe Commerce 安全漏洞 — Adobe Commerce | 8.1 | High | 2024-06-13 |
| CVE-2024-5798 | HashiCorp Vault 安全漏洞 — Vault | 2.6 | Low | 2024-06-12 |
| CVE-2024-36264 | Apache Submarine 授权问题漏洞 — Apache Submarine Commons Utils | 7.5AI | High AI | 2024-06-12 |
| CVE-2024-36266 | Siemens PowerSys 授权问题漏洞 — PowerSys | 9.3 | Critical | 2024-06-11 |
| CVE-2024-5732 | Clash 授权问题漏洞 — Clash | 7.3 | High | 2024-06-07 |
| CVE-2024-37152 | Argo CD 安全漏洞 — argo-cd | 5.3 | Medium | 2024-06-06 |
| CVE-2023-51511 | WordPress plugin Booster Elite for WooCommerce 授权问题漏洞 — Booster Elite for WooCommerce | 6.5 | Medium | 2024-06-04 |
| CVE-2023-48747 | WordPress plugin Booster for WooCommerce 授权问题漏洞 — Booster for WooCommerce | 6.5 | Medium | 2024-06-04 |
| CVE-2023-47189 | WordPress plugin Defender Security 授权问题漏洞 — Defender Security | 5.3 | Medium | 2024-06-04 |
| CVE-2023-46630 | WordPress plugin Admin and Site Enhancements 安全漏洞 — Admin and Site Enhancements (ASE) | 7.5 | High | 2024-06-04 |
| CVE-2023-43551 | Qualcomm 芯片 安全漏洞 — Snapdragon | 9.1 | Critical | 2024-06-03 |
| CVE-2024-5201 | OpenText Dimensions RM 安全漏洞 — Dimensions RM | 8.8 | High | 2024-05-23 |
| CVE-2024-5044 | Emlog Pro 授权问题漏洞 — Emlog Pro | 3.7 | Low | 2024-05-17 |
| CVE-2023-41956 | WordPress plugin Simple Membership 授权问题漏洞 — Simple Membership | 8.8 | High | 2024-05-17 |
| CVE-2024-35184 | Paperless-ngx 安全漏洞 — paperless-ngx | 5.5 | Medium | 2024-05-15 |
| CVE-2024-3487 | NetIQ iManager 安全漏洞 — iManager | 3.5 | Low | 2024-05-15 |
| CVE-2024-34340 | Cacti 安全漏洞 — cacti | 9.1 | Critical | 2024-05-13 |
| CVE-2024-4129 | Snow Software Snow License Manager 授权问题漏洞 — Snow License Manager | 8.8 | High | 2024-05-10 |
| CVE-2024-4601 | Socomec Net Vision 授权问题漏洞 — Net vision | 6.7 | Medium | 2024-05-07 |
| CVE-2023-38096 | NETGEAR ProSAFE 安全漏洞 — ProSAFE Network Management System | 9.8 | - | 2024-05-03 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1486 条 CVE 漏洞。