目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1483

CWE-287 认证机制不恰当 类弱点 1483 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-42818 Jumpserver 授权问题漏洞 — jumpserver 5.4 Medium 2023-09-27
CVE-2023-31015 NVIDIA DGX 授权问题漏洞 — DGX H100 BMC 6.6 Medium 2023-09-20
CVE-2023-0773 Uniview IP Camera 授权问题漏洞 — Uniview IP Camera IPC322LB-SF28-A 9.1 Critical 2023-09-19
CVE-2023-42442 Jumpserver 授权问题漏洞 — jumpserver 8.2 High 2023-09-15
CVE-2023-4985 Supcon InPlant SCADA 授权问题漏洞 — InPlant SCADA 5.9 Medium 2023-09-15
CVE-2023-4568 PaperCut NG 授权问题漏洞 — PaperCut NG 6.5 Medium 2023-09-13
CVE-2023-4501 OpenText Visual COBOL 授权问题漏洞 — Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server 9.8 Critical 2023-09-12
CVE-2023-29463 Rockwell Automation Pavilion8 授权问题漏洞 — Pavilion8 8.8 High 2023-09-12
CVE-2023-4816 Hitachi Energy Asset Suite 授权问题漏洞 — Asset Suite 9 6.9 Medium 2023-09-11
CVE-2023-20238 Cisco BroadWorks Application 安全漏洞 — Cisco BroadWorks 10.0 Critical 2023-09-06
CVE-2023-41751 Acronis Agent 授权问题漏洞 — Acronis Agent 7.5 - 2023-08-31
CVE-2023-32202 Walchem Intuition 授权问题漏洞 — Intuition 9 6.5 Medium 2023-08-23
CVE-2023-4415 Ruijie Networks RG-EW1200G 授权问题漏洞 — RG-EW1200G 7.3 High 2023-08-18
CVE-2023-32453 Dell BIOS 授权问题漏洞 — CPG BIOS 4.6 Medium 2023-08-16
CVE-2023-40020 PrivateUploader 授权问题漏洞 — PrivateUploader 9.9 Critical 2023-08-14
CVE-2023-39531 Mobileiron Sentry 授权问题漏洞 — sentry 6.5 Medium 2023-08-09
CVE-2023-4242 WordPress plugin FULL - Customer 授权问题漏洞 — FULL – Cliente 4.3 Medium 2023-08-09
CVE-2023-38691 Matrix-appservice-bridge 授权问题漏洞 — matrix-appservice-bridge 5.0 Medium 2023-08-04
CVE-2023-20214 Cisco SD-WAN vManage 授权问题漏洞 — Cisco SD-WAN vManage 9.1 Critical 2023-08-03
CVE-2023-3622 SolarWinds Platform 授权问题漏洞 — SolarWinds Platform 4.3 Medium 2023-07-26
CVE-2023-2626 Google Nest 授权问题漏洞 — Nest Hub Max 7.5 High 2023-07-25
CVE-2023-37918 Dapr 授权问题漏洞 — dapr 6.8 Medium 2023-07-21
CVE-2023-37471 OpenAM 授权问题漏洞 — OpenAM 9.1 Critical 2023-07-20
CVE-2023-3638 GeoVision GV-ADR2701 授权问题漏洞 — GV-ADR2701 9.8 Critical 2023-07-19
CVE-2022-34155 WordPress Plugin OAuth Single Sign On – SSO 授权问题漏洞 — OAuth Single Sign On – SSO (OAuth Client) 8.8 High 2023-07-18
CVE-2023-37266 CasaOS 授权问题漏洞 — CasaOS 9.8 Critical 2023-07-17
CVE-2023-3591 Mattermost 授权问题漏洞 — Mattermost 4.8 Medium 2023-07-17
CVE-2023-35901 IBM Robotic Process Automation 授权问题漏洞 — Robotic Process Automation 2.7 Low 2023-07-16
CVE-2023-37268 Warpgate 授权问题漏洞 — warpgate 6.4 Medium 2023-07-14
CVE-2023-30560 BD Alaris System with Guardrails Suite MX 授权问题漏洞 — BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015 6.8 Medium 2023-07-13

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1483 条 CVE 漏洞。