目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1746

CWE-287 认证机制不恰当 类弱点 1746 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-1541 Cisco Small Business 220 Series Smart Switches 授权问题漏洞 — Cisco Small Business 220 Series Smart Plus Switches 7.2 High 2021-06-16
CVE-2021-22764 Schneider Electric PowerLogic 授权问题漏洞 — PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation) 5.3 - 2021-06-11
CVE-2021-25389 Samsung SMR 授权问题漏洞 — Samsung Mobile Devices 2.3 Low 2021-06-11
CVE-2021-25424 Tizen bluetooth-frwk 授权问题漏洞 — Tizen wearable devices 8.3 - 2021-06-11
CVE-2021-23847 Bosch IP cameras 访问控制错误漏洞 — CPP Firmware 9.8 Critical 2021-06-09
CVE-2020-14380 Red Hat Satellite 授权问题漏洞 — Red Hat Satellite 7.5 - 2021-06-02
CVE-2021-3424 Red Hat Single Sign-On 7安全漏洞 — keycloak 4.3 - 2021-06-01
CVE-2021-32646 Roomer 授权问题漏洞 — Dav-Cogs 5.3 Medium 2021-05-28
CVE-2021-32637 Github authelia 授权问题漏洞 — authelia 10.0 Critical 2021-05-28
CVE-2021-32543 嘉实资讯 CTS Web transaction system 授权问题漏洞 — CTS Web 6.5 Medium 2021-05-28
CVE-2020-10709 Red Hat Ansible 代码问题漏洞 — Tower 7.1 - 2021-05-27
CVE-2018-16496 Versa Networks Versa Director 授权问题漏洞 — Versa Director 5.3 - 2021-05-26
CVE-2002-2438 TCP 授权问题漏洞 — kernel 7.5 - 2021-05-18
CVE-2021-27651 PEGA pega infinity 授权问题漏洞 — Pega Infinity 7.8 - 2021-04-29
CVE-2021-22893 Pulse Secure Pulse Connect Secure 资源管理错误漏洞 — Pulse Connect Secure 10.0 - 2021-04-23
CVE-2020-7856 Helpcom 授权问题漏洞 — Helpcom 7.5 High 2021-04-20
CVE-2021-20288 红帽 Red Hat Ceph 授权问题漏洞 — ceph 9.8 - 2021-04-15
CVE-2021-20020 SonicWall Global Management System 授权问题漏洞 — Global Management System (GMS) 9.8 - 2021-04-10
CVE-2021-25377 Samsung Experience Service 授权问题漏洞 — Samsung Experience Service 3.3 Low 2021-04-09
CVE-2021-28174 Mitake smart stock selection system 授权问题漏洞 — Mitake Smart Stock Selection System 6.5 Medium 2021-04-08
CVE-2021-24175 WordPress Elementor Page Builder 授权问题漏洞 — The Plus Addons for Elementor Page Builder 9.8 - 2021-04-05
CVE-2021-25368 Samsung Cloud 授权问题漏洞 — Samsung Cloud 3.3 Low 2021-03-25
CVE-2021-24148 Wordpress MStore API 授权问题漏洞 — MStore API 7.5 - 2021-03-18
CVE-2021-21378 Envoy 授权问题漏洞 — envoy 8.2 High 2021-03-11
CVE-2020-27838 Red Hat Keycloak 授权问题漏洞 — keycloak 4.3 - 2021-03-08
CVE-2021-21335 spnego-http-auth-nginx-module 授权问题漏洞 — spnego-http-auth-nginx-module 5.3 Medium 2021-03-08
CVE-2021-21329 RATCF 授权问题漏洞 — core 8.7 High 2021-03-08
CVE-2020-5148 SonicWall SSO-agent 授权问题漏洞 — Directory Services Connector 9.8 - 2021-03-05
CVE-2021-25347 Samsung Email application 授权问题漏洞 — Samsung Mobile Devices 5.3 Medium 2021-03-04
CVE-2021-25343 Samsung mobile devices 授权问题漏洞 — Samsung Members 4.0 Medium 2021-03-04

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1746 条 CVE 漏洞。