目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1744

CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2019-6527 Kunbus PR100088 Modbus 授权问题漏洞 — PR100088 Modbus gateway 9.8 - 2019-02-12
CVE-2019-3825 GNOME Display Manager 授权问题漏洞 — gdm 5.7 - 2019-02-06
CVE-2018-17928 ABB CMS-770 授权问题漏洞 — CMS-770 4.6 - 2019-01-31
CVE-2018-17926 ABB M2M ETHERNET FW 授权问题漏洞 — M2M ETHERNET 4.3 - 2019-01-31
CVE-2018-16886 etcd 授权问题漏洞 — etcd: 8.1 - 2019-01-14
CVE-2018-15721 Logitech Harmony Hub XMPP服务器安全漏洞 — Logitech Harmony Hub 9.8 - 2018-12-20
CVE-2018-13804 Siemens SIMATIC IT LMS、SIMATIC IT Production Suite和SIMATIC IT UA Discrete Manufacturing 授权问题漏洞 — SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing 8.1 - 2018-12-13
CVE-2018-14637 Red Hat keycloak 安全漏洞 — keycloak 5.9 - 2018-11-30
CVE-2016-2125 Samba 输入验证错误漏洞 — samba 8.1 - 2018-10-31
CVE-2018-16464 Nextcloud Server 授权问题漏洞 — Nextcloud Server 6.3 - 2018-10-30
CVE-2018-16465 Nextcloud Server 授权问题漏洞 — Nextcloud Server 5.3 - 2018-10-30
CVE-2018-17923 GAIN SAGA1-L Series产品授权问题漏洞 — SAGA1-L8B 6.4 - 2018-10-24
CVE-2018-0435 Cisco Umbrella API 授权问题漏洞 — Cisco Umbrella 5.4 - 2018-10-05
CVE-2018-12472 Micro Focus SUSE Linux 安全漏洞 — SMT 8.2 - 2018-10-04
CVE-2018-14826 Entes EMG12 安全漏洞 — EMG12 9.8 - 2018-10-02
CVE-2017-14026 Ice Qube Thermal Management Center 安全漏洞 — Thermal Management Center 7.5 - 2018-09-06
CVE-2018-14805 ABB eSOMS 授权问题漏洞 — ABB eSOMS 8.1 - 2018-08-29
CVE-2018-14786 多款BD产品授权问题漏洞 — Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA 9.8 - 2018-08-23
CVE-2017-16748 Tridium Niagara AX Framework和Niagara 4 Framework 授权问题漏洞 — Niagara AX Framework and Niagara 4 Framework 7.8 - 2018-08-20
CVE-2018-3775 Nextcloud Server 授权问题漏洞 — Nextcloud Server 8.8 - 2018-08-12
CVE-2017-12195 Openshift Enterprise 授权问题漏洞 — OpenShift 4.8 - 2018-07-27
CVE-2018-5387 Wizkunde SAMLBase 数据伪造问题漏洞 — SAMLBase 7.5 - 2018-07-24
CVE-2018-3761 Nextcloud Server 安全漏洞 — Nextcloud Server 9.1 - 2018-07-05
CVE-2018-4856 Siemens SICLOCK TC100和SICLOCK TC400 安全漏洞 — SICLOCK TC100, SICLOCK TC400 4.9 - 2018-07-03
CVE-2018-0362 Cisco 5000 Series Enterprise Network Compute System和UCS E-Series Servers 授权问题漏洞 — Cisco 5000 Series Enterprise Network Compute System and Cisco UCS E-Series Servers unknown 7.3 - 2018-06-21
CVE-2018-0321 Cisco Prime Collaboration Provisioning 授权问题漏洞 — Cisco Prime Collaboration Provisioning unknown 9.8 - 2018-06-07
CVE-2017-7931 ABB IP GATEWAY 安全漏洞 — ABB IP GATEWAY 9.1 - 2018-06-06
CVE-2018-10597 多款Philips产品授权问题漏洞 — IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors 8.0 - 2018-06-05
CVE-2018-10611 GE MDS PulseNET和MDS PulseNET Enterprise 授权问题漏洞 — MDS PulseNET and MDS PulseNET Enterprise 9.8 - 2018-06-04
CVE-2018-8862 多款Acoustic产品授权问题漏洞 — Emergency Mass Notification Systems 3.1 - 2018-05-25

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。