目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1486

CWE-287 认证机制不恰当 类弱点 1486 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2024-4303 ArmorX Android APP 授权问题漏洞 — ArmorX APP 8.8 High 2024-04-29
CVE-2023-6787 Red Hat Keycloak 安全漏洞 6.5 Medium 2024-04-25
CVE-2023-3597 Red Hat Keycloak 安全漏洞 5.0 Medium 2024-04-25
CVE-2023-51484 WordPress plugin Login as User or Customer 授权问题漏洞 — Login as User or Customer (User Switching) 9.8 Critical 2024-04-25
CVE-2023-51482 WordPress plugin Eazy Plugin Manager 授权问题漏洞 — Eazy Plugin Manager 9.9 Critical 2024-04-25
CVE-2023-51478 WordPress plugin Build App Online 授权问题漏洞 — Build App Online 9.8 Critical 2024-04-25
CVE-2023-51477 WordPress plugin BuddyBoss 授权问题漏洞 — BuddyBoss Theme 9.8 Critical 2024-04-24
CVE-2023-51472 WordPress plugin Checkout Mestres do WP for WooCommerce 授权问题漏洞 — Checkout Mestres WP 9.8 Critical 2024-04-24
CVE-2023-51471 WordPress plugin Checkout Mestres do WP for WooCommerce 授权问题漏洞 — Checkout Mestres WP 8.2 High 2024-04-24
CVE-2023-51405 WordPress plugin BookingPress 授权问题漏洞 — BookingPress 8.2 High 2024-04-24
CVE-2023-47504 WordPress plugin Elementor Website Builder 授权问题漏洞 — Elementor Website Builder 6.5 Medium 2024-04-24
CVE-2023-25790 WordPress plugin WoodMart 输入验证错误漏洞 — WoodMart 5.3 Medium 2024-04-24
CVE-2024-2112 WordPress Plugin Form Maker by 10Web 安全漏洞 — Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 5.9 Medium 2024-04-09
CVE-2024-25699 Esri Portal For ArcGIS 授权问题漏洞 — Portal for ArcGIS 8.5 High 2024-04-04
CVE-2024-28012 NEC Corporation Aterm 安全漏洞 — WG1800HP4 9.1AI Critical AI 2024-03-28
CVE-2024-28009 NEC Corporation Aterm 安全漏洞 — WG1800HP4 9.1AI Critical AI 2024-03-28
CVE-2024-28007 NEC Corporation Aterm 安全漏洞 — WG1800HP4 9.1AI Critical AI 2024-03-28
CVE-2024-28006 NEC Corporation Aterm 安全漏洞 — WG1800HP4 9.1AI Critical AI 2024-03-28
CVE-2024-2244 Hitachi Energy Asset Suite 安全漏洞 — Asset Suite EAM 5.3 Medium 2024-03-27
CVE-2024-2873 wolfSSH 安全漏洞 — wolfSSH 9.1 Critical 2024-03-25
CVE-2024-2862 LG LED Assistant 安全漏洞 — LG LED Assistant 9.1 Critical 2024-03-25
CVE-2022-44595 WordPress Plugin WP 2FA 授权问题漏洞 — WP 2FA 5.3 Medium 2024-03-21
CVE-2024-1148 OpenText PVCS Version Manager 安全漏洞 — PVCS Version Manager 9.8 Critical 2024-03-21
CVE-2024-1147 OpenText PVCS Version Manager 安全漏洞 — PVCS Version Manager 9.8 Critical 2024-03-21
CVE-2024-27767 Unitronics Unistream Unilogic 安全漏洞 — Unistream Unilogic 10.0 Critical 2024-03-18
CVE-2024-28255 OpenMetadata 安全漏洞 — OpenMetadata 9.8 Critical 2024-03-15
CVE-2024-2450 Mattermost 安全漏洞 — Mattermost 8.8 High 2024-03-15
CVE-2024-25652 Delinea PAM Secret Server 安全漏洞 — Secret Server 7.6 High 2024-03-14
CVE-2023-38534 OpenText Exceed Turbo X 安全漏洞 — Exceed Turbo X 8.6 High 2024-03-13
CVE-2024-0799 Arcserve Unified Data Protection 安全漏洞 — Unified Data Protection 9.8 Critical 2024-03-13

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1486 条 CVE 漏洞。