目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1744

CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-25315 SUSE Linux Enterprise Server 授权问题漏洞 — SUSE Linux Enterprise Server 15 SP 3 9.8 Critical 2021-03-03
CVE-2021-21513 Dell EMC OpenManage Server Administrator 授权问题漏洞 — Dell Open Manage Server Administrator 8.6 High 2021-03-02
CVE-2021-21308 PrestaShop 授权问题漏洞 — PrestaShop 6.1 Medium 2021-02-26
CVE-2021-22858 昌佳财务管理系统 代码问题漏洞 — property management system 8.8 High 2021-02-17
CVE-2021-25910 ZIV 4CCT 授权问题漏洞 — 4CCT-EA6-334126BF 8.0 High 2021-01-29
CVE-2021-26117 Apache ActiveMQ 授权问题漏洞 — Apache ActiveMQ 7.5 - 2021-01-27
CVE-2020-24675 ABB Symphony Plus Operations 和 ABB Symphony Plus Historian 授权问题漏洞 — ABB Ability™ Symphony® Plus Operations 9.8 Critical 2020-12-22
CVE-2020-27254 X-STREAM enhanced XEGP 授权问题漏洞 — Emerson Rosemount X-STREAM Gas Analyzer 7.5 - 2020-12-21
CVE-2020-27780 Linux-pam 授权问题漏洞 — pam 9.8 - 2020-12-17
CVE-2020-16102 Gallagher Group Command Centre 访问控制错误漏洞 — Command Centre 7.1 High 2020-12-14
CVE-2020-25183 Medtronic MyCareLink Smart Model 25000 Patient Reader 授权问题漏洞 — Smart Model 25000 Patient Reader 8.0 High 2020-12-14
CVE-2020-7533 多款 Schneider Electric 产品信任管理问题漏洞 — Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see security notification for version information) 9.8 - 2020-12-01
CVE-2020-1778 OTRS ITSM 授权问题漏洞 — OTRS 4.1 Medium 2020-11-23
CVE-2020-26236 ScratchVerifier 授权问题漏洞 — ScratchVerifier 7.5 High 2020-11-20
CVE-2020-8272 Citrix Systems SD-WAN Center 授权问题漏洞 — Citrix SD-WAN Center 7.5 - 2020-11-16
CVE-2020-25165 BD Alaris PC Unit和BD Alaris Systems Manager 授权问题漏洞 — BD Alaris PC Unit and BD Alaris Systems Manager 7.5 - 2020-11-13
CVE-2020-26214 Alerta 授权问题漏洞 — alerta 9.1 Critical 2020-11-06
CVE-2020-8267 Ubiquiti Networks UniFi Cloud Key 授权问题漏洞 — UniFi Protect 8.2 - 2020-11-05
CVE-2020-5425 VMware Tanzu 授权问题漏洞 — Single Sign-On for VMware Tanzu 8.2 - 2020-10-31
CVE-2020-8236 Nextcloud 授权问题漏洞 — Nextcloud Server 6.1 - 2020-10-30
CVE-2020-3410 Cisco Firepower Management Center 授权问题漏洞 — Cisco Firepower Management Center 8.1 High 2020-10-21
CVE-2020-15240 Auth0 omniauth-auth0 数据伪造问题漏洞 — omniauth-auth0 7.4 High 2020-10-21
CVE-2020-15269 Spree 代码问题漏洞 — spree 7.4 High 2020-10-20
CVE-2020-14299 PicketBox 授权问题漏洞 — picketbox 6.5 - 2020-10-16
CVE-2020-8350 Lenovo ThinkPad Stack Wireless Router 授权问题漏洞 — ThinkPad Stack WIreless Router firmware 8.8 High 2020-10-14
CVE-2020-15243 yed 访问控制错误漏洞 — SmartStoreNET 9.1 Critical 2020-10-08
CVE-2020-15222 ORY Fosite 数据伪造问题漏洞 — fosite 8.1 High 2020-09-24
CVE-2019-16028 Cisco Firepower Management Center 授权问题漏洞 — Cisco Firepower Management Center 9.8 - 2020-09-23
CVE-2020-8200 Citrix StoreFront 授权问题漏洞 — Citrix StoreFront 6.5 - 2020-09-18
CVE-2020-8253 Citrix XenMobile Server 授权问题漏洞 — Citrix XenMobile Server 7.5 - 2020-09-18

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。