CWE-288 使用候选路径或通道进行的认证绕过 类弱点 552 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-11349 | WordPress plugin AdForest 安全漏洞 — AdForest | 9.8 | Critical | 2024-12-21 |
| CVE-2024-43234 | WordPress plugin Woffice 安全漏洞 — Woffice | 9.8 | Critical | 2024-12-16 |
| CVE-2024-56013 | WordPress plugin Wovax IDX 安全漏洞 — Wovax IDX | 8.8 | High | 2024-12-16 |
| CVE-2024-54336 | WordPress plugin Projectopia 安全漏洞 — Projectopia | 8.8 | High | 2024-12-13 |
| CVE-2024-54297 | WordPress plugin vBSSO-lite 安全漏洞 — vBSSO-lite | 9.8 | Critical | 2024-12-13 |
| CVE-2024-54296 | WordPress plugin CoSchool LMS 安全漏洞 — CoSchool LMS | 9.8 | Critical | 2024-12-13 |
| CVE-2024-54294 | WordPress plugin Firebase OTP Authentication 安全漏洞 — Firebase OTP Authentication | 9.8 | Critical | 2024-12-13 |
| CVE-2024-54295 | WordPress plugin ListApp Mobile Manager 安全漏洞 — ListApp Mobile Manager | 9.8 | Critical | 2024-12-13 |
| CVE-2024-11639 | Ivanti CSA 安全漏洞 — Cloud Services Application | 10.0 | Critical | 2024-12-10 |
| CVE-2024-52586 | eLabFTW 安全漏洞 — elabftw | 5.4 | Medium | 2024-12-09 |
| CVE-2024-11178 | WordPress plugin Login With OTP 安全漏洞 — Login with OTP | 8.1 | High | 2024-12-06 |
| CVE-2024-25036 | IBM Cognos Controller 安全漏洞 — Cognos Controller | 4.3 | Medium | 2024-12-03 |
| CVE-2024-10490 | B&R Industrial Automation mapp 安全漏洞 — B&R mapp Cockpit | 9.8 | - | 2024-12-02 |
| CVE-2024-11981 | Billion Electric多款产品 安全漏洞 — M100 | 7.5 | High | 2024-11-29 |
| CVE-2024-52475 | WordPress plugin Wawp 安全漏洞 — Wawp | 9.8 | Critical | 2024-11-28 |
| CVE-2024-11925 | WordPress plugin JobSearch 安全漏洞 — JobSearch WP Job Board | 9.8 | Critical | 2024-11-28 |
| CVE-2024-33610 | Sharp MFP 安全漏洞 — Multiple MFPs (multifunction printers) | 9.1 | Critical | 2024-11-26 |
| CVE-2024-10961 | WordPress plugin Social Login 安全漏洞 — Social Login | 9.8 | Critical | 2024-11-23 |
| CVE-2024-10311 | WordPress plugin External Database Based Actions 安全漏洞 — External Database Based Actions | 7.5 | High | 2024-11-15 |
| CVE-2024-10924 | WordPress plugin Really Simple Security 安全漏洞 — Really Simple Security Pro multisite | 9.8 | Critical | 2024-11-15 |
| CVE-2024-47574 | Fortinet FortiClient 安全漏洞 — FortiClientWindows | 7.4 | High | 2024-11-13 |
| CVE-2024-11028 | WordPress plugin MultiManager WP 安全漏洞 — MultiManager WP – Manage All Your WordPress Sites Easily | 9.8 | Critical | 2024-11-13 |
| CVE-2024-10245 | WordPress plugin Relais 2FA 安全漏洞 — Relais 2FA | 9.8 | Critical | 2024-11-12 |
| CVE-2024-10284 | WordPress plugin CE21 Suite 安全漏洞 — CE21 Suite | 9.8 | Critical | 2024-11-09 |
| CVE-2024-10081 | CodeChecker 安全漏洞 — CodeChecker | 10.0 | Critical | 2024-11-06 |
| CVE-2024-50503 | WordPress plugin User Toolkit 安全漏洞 — User Toolkit | 9.8 | Critical | 2024-10-30 |
| CVE-2024-9989 | WordPress plugin Crypto 安全漏洞 — Crypto Tool | 9.8 | Critical | 2024-10-29 |
| CVE-2024-9988 | WordPress plugin Crypto 安全漏洞 — Crypto Tool | 9.8 | Critical | 2024-10-29 |
| CVE-2024-50334 | Scoold 安全漏洞 — scoold | 7.5AI | High AI | 2024-10-29 |
| CVE-2024-50488 | WordPress plugin Token Login 安全漏洞 — Token Login | 8.8 | High | 2024-10-28 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 552 条 CVE 漏洞。