目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1744

CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-84114 Cleo Harmony 授权问题漏洞 — Harmony 6.3 Medium 2026-09-01
CVE-2026-77194 WordPress Simple Membership 授权问题漏洞 — Simple Membership 5.3 Medium 2026-09-01
CVE-2026-19806 WordPress Support Genix 授权问题漏洞 — Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System 8.8 High 2026-09-01
CVE-2026-61641 Miguel Ribeiro Wallos 授权问题漏洞 — Wallos 8.1 High 2026-08-31
CVE-2026-54600 Miguel Ribeiro Wallos 授权问题漏洞 — Wallos 8.2 High 2026-08-31
CVE-2026-49003 ZTE ZXDU68 S202 授权问题漏洞 — ZXDU68 S202 V5.0 9.6 Critical 2026-08-31
CVE-2026-82547 Magma 授权问题漏洞 — Magma 6.5 Medium 2026-08-30
CVE-2026-75807 WordPress SAML Single Sign On 授权问题漏洞 — SAML Single Sign On – SSO Login 7.5 High 2026-08-29
CVE-2026-82466 jeremyevans rodauth 授权问题漏洞 — rodauth 8.7 High 2026-08-29
CVE-2026-18891 IBM Langflow OSS 授权问题漏洞 — Langflow OSS 8.2 High 2026-08-28
CVE-2026-17203 IBM administration runtime expert for i 授权问题漏洞 — Administration Runtime Expert for i 7.5 High 2026-08-28
CVE-2026-82329 JFrog Artifactory 授权问题漏洞 — artifactory 9.8 Critical 2026-08-28
CVE-2026-73208 Open-Xchange Dovecot Pro 授权问题漏洞 — OX Dovecot Pro 7.4 High 2026-08-28
CVE-2026-42008 Open-Xchange Dovecot Pro 授权问题漏洞 — OX Dovecot Pro 4.3 Medium 2026-08-28
CVE-2026-40205 Open-Xchange Dovecot Pro 授权问题漏洞 — OX Dovecot Pro 5.9 Medium 2026-08-28
CVE-2026-81703 Tobi OpenSSL Encrypt 授权问题漏洞 — openssl_encrypt 5.5 Medium 2026-08-27
CVE-2026-79938 Dell PowerProtect Cyber Recovery 授权问题漏洞 — Power Protect Cyber Recovery 7.6 High 2026-08-26
CVE-2026-80192 Better Auth 授权问题漏洞 — sso 8.1 High 2026-08-25
CVE-2026-44476 doorkeeper gem Doorkeeper::OpenidConnect 授权问题漏洞 — doorkeeper-openid_connect 6.3 Medium 2026-08-25
CVE-2026-68569 Apache Tomcat 授权问题漏洞 — Apache Tomcat - - 2026-08-25
CVE-2026-79787 Alluxio 授权问题漏洞 — alluxio 9.8 Critical 2026-08-25
CVE-2026-24170 NVIDIA Unified Fabric Manager Enterprise 授权问题漏洞 — Unified Fabric Manager Enterprise - GA 8.8 High 2026-08-25
CVE-2026-55533 MervinPraison PraisonAI 授权问题漏洞 — PraisonAI 8.2 High 2026-08-25
CVE-2026-78885 TREK 授权问题漏洞 — TREK 5.6 Medium 2026-08-25
CVE-2026-78863 TREK 授权问题漏洞 — TREK 6.3 Medium 2026-08-25
CVE-2026-53561 Apache Hive 授权问题漏洞 — Apache Hive - - 2026-08-25
CVE-2026-65633 Alembic Ash Authentication 授权问题漏洞 — ash_authentication 7.6 High 2026-08-25
CVE-2026-77567 filamentphp filament 授权问题漏洞 — filament 8.1 High 2026-08-24
CVE-2026-66908 Apache Camel 授权问题漏洞 — Apache Camel - - 2026-08-24
CVE-2026-78168 EFM iptime t24000m 授权问题漏洞 — ipTIME T24000M 9.8 Critical 2026-08-24

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。