CWE-287 认证机制不恰当 类弱点 1474 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-2638 | Rockwell Automation FactoryTalk Services Platform 授权问题漏洞 — FactoryTalk System Services | 5.9 | Medium | 2023-06-13 |
| CVE-2023-20867 | VMware Tools 授权问题漏洞 — VMware Tools | 3.9 | Low | 2023-06-13 |
| CVE-2023-34246 | Doorkeeper 授权问题漏洞 — doorkeeper | 4.2 | Medium | 2023-06-12 |
| CVE-2023-32682 | Matrix Synapse 授权问题漏洞 — synapse | 5.4 | Medium | 2023-06-06 |
| CVE-2023-3065 | Mobatime 授权问题漏洞 — Mobatime mobile application AMXGT100 | 9.1 | Critical | 2023-06-05 |
| CVE-2023-2283 | libssh 授权问题漏洞 — libssh | 7.5 | - | 2023-05-26 |
| CVE-2023-2586 | Teltonika Remote Management System 授权问题漏洞 — Remote Management System | 9.0 | Critical | 2023-05-22 |
| CVE-2023-32347 | Teltonika Remote Management System 授权问题漏洞 — Remote Management System | 8.1 | High | 2023-05-22 |
| CVE-2023-2024 | Johnson Controls OpenBlue Enterprise Manager Data Collector 授权问题漏洞 — OpenBlue Enterprise Manager Data Collector | 10.0 | Critical | 2023-05-18 |
| CVE-2023-0863 | ABB Terra AC wallbox 授权问题漏洞 — Terra AC wallbox (UL40/80A) | 8.8 | High | 2023-05-17 |
| CVE-2023-2706 | WordPress plugin OTP Login Woocommerce & Gravity Forms 授权问题漏洞 — OTP Login & Register Woocommerce | 8.1 | High | 2023-05-17 |
| CVE-2023-32081 | vert.x-stomp 授权问题漏洞 — vertx-stomp | 6.5 | Medium | 2023-05-12 |
| CVE-2023-29032 | Apache OpenMeetings 授权问题漏洞 — Apache OpenMeetings | 8.8 | - | 2023-05-12 |
| CVE-2023-32243 | WordPress plugin Essential Addons for Elementor 授权问题漏洞 — Essential Addons for Elementor | 9.8 | Critical | 2023-05-12 |
| CVE-2023-28125 | Ivanti Avalanche 竞争条件问题漏洞 — Avalanche | 9.8 | - | 2023-05-09 |
| CVE-2023-31123 | tripreporter 授权问题漏洞 — tripreporter | 9.1 | Critical | 2023-05-08 |
| CVE-2023-21487 | SAMSUNG Mobile devices 授权问题漏洞 — Samsung Mobile Devices | 5.1 | Medium | 2023-05-04 |
| CVE-2023-21484 | SAMSUNG Mobile devices 授权问题漏洞 — Samsung Mobile Devices | 5.1 | Medium | 2023-05-04 |
| CVE-2022-30995 | Acronis Cyber Backup和Acronis Cyber Protect 授权问题漏洞 — Acronis Cyber Protect 15 | 7.5 | - | 2023-05-03 |
| CVE-2023-30869 | WordPress plugin Easy Digital Downloads 授权问题漏洞 — Easy Digital Downloads | 9.8 | Critical | 2023-05-02 |
| CVE-2023-1477 | HYPR 授权问题漏洞 — Keycloak Authenticator Extension | 7.2 | High | 2023-04-28 |
| CVE-2023-1778 | GajShield Data Security Firewall 安全漏洞 — Data Security Firewall | 10.0 | Critical | 2023-04-27 |
| CVE-2023-30845 | Google ESPv2 授权问题漏洞 — esp-v2 | 8.2 | High | 2023-04-26 |
| CVE-2022-45456 | Acronis Agent 安全漏洞 — Acronis Agent | 7.5 | - | 2023-04-26 |
| CVE-2023-0209 | NVIDIA DGX-1 授权问题漏洞 — NVIDIA DGX servers | 8.2 | High | 2023-04-22 |
| CVE-2023-25601 | Apache DolphinScheduler 授权问题漏洞 — Apache DolphinScheduler | 9.1 | - | 2023-04-20 |
| CVE-2023-27351 | PaperCut NG 授权问题漏洞 — NG | 9.8 | - | 2023-04-20 |
| CVE-2023-25556 | Schneider Electric StruxureWare Data Center Expert 授权问题漏洞 — Merten INSTABUS Tastermodul 1fach System M 625199 | 8.3 | High | 2023-04-18 |
| CVE-2023-24831 | Apache IoTDB 授权问题漏洞 — Apache IoTDB | 8.8 | - | 2023-04-17 |
| CVE-2023-28963 | Juniper Networks Junos OS 授权问题漏洞 — Junos OS | 5.3 | Medium | 2023-04-17 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1474 条 CVE 漏洞。