CWE-288 使用候选路径或通道进行的认证绕过 类弱点 546 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-1646 | LoLLMs 安全漏洞 — parisneo/lollms-webui | 9.8 | - | 2024-04-16 |
| CVE-2024-2056 | Artica Proxy 安全漏洞 — Artica Proxy | 7.5AI | High AI | 2024-03-05 |
| CVE-2024-2055 | Artica Proxy 安全漏洞 — Artica Proxy | 9.8AI | Critical AI | 2024-03-05 |
| CVE-2024-27198 | JetBrains TeamCity 安全漏洞 — TeamCity | 9.8 | Critical | 2024-03-04 |
| CVE-2024-1525 | GitLab 访问控制错误漏洞 — GitLab | 5.3 | Medium | 2024-02-21 |
| CVE-2024-1709 | ConnectWise ScreenConnect 安全漏洞 — ScreenConnect | 10.0 | Critical | 2024-02-21 |
| CVE-2024-21491 | svix 安全漏洞 — svix | 5.9 | Medium | 2024-02-13 |
| CVE-2024-23917 | JetBrains TeamCity 安全漏洞 — TeamCity | 9.8 | Critical | 2024-02-06 |
| CVE-2023-6718 | Repox 安全漏洞 — Repox | 9.4 | Critical | 2023-12-13 |
| CVE-2023-2437 | WordPress Plugin UserPro 安全漏洞 — UserPro - Community and User Profile WordPress Plugin | 9.8 | Critical | 2023-11-22 |
| CVE-2023-42770 | Red Lion Controls SixTRAK和VersaTRAK 安全漏洞 — ST-IPm-8460 | 10.0 | Critical | 2023-11-21 |
| CVE-2023-3277 | WordPress Plugin MStore API 安全漏洞 — MStore API – Create Native Android & iOS Apps On The Cloud | 9.8 | Critical | 2023-11-03 |
| CVE-2023-41351 | Nokia G-040W-Q 安全漏洞 — NOKIA G-040W-Q | 9.8 | Critical | 2023-11-03 |
| CVE-2023-20247 | Cisco Firepower Threat Defense 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 5.0 | Medium | 2023-11-01 |
| CVE-2023-46747 | F5 BIG-IP Configuration utility 安全漏洞 — BIG-IP | 9.8 | Critical | 2023-10-26 |
| CVE-2023-39930 | Ping Identity PingFederate 访问控制错误漏洞 — PingID Radius PCV | 7.5 | High | 2023-10-24 |
| CVE-2023-39231 | Ping Identity PingFederate 访问控制错误漏洞 — PingOne MFA Integration Kit | 7.3 | High | 2023-10-24 |
| CVE-2023-43045 | IBM Sterling Partner Engagement Manager 访问控制错误漏洞 — Sterling Partner Engagement Manager | 5.9 | Medium | 2023-10-23 |
| CVE-2021-4353 | WordPress Plugin WooCommerce Dynamic Pricing and Discounts 安全漏洞 — WooCommerce Dynamic Pricing and Discounts | 5.3 | Medium | 2023-10-20 |
| CVE-2023-4957 | Zebra Technologies Industrial Printers 安全漏洞 — ZTC ZT410 | 5.4 | Medium | 2023-10-11 |
| CVE-2023-1260 | Red Hat openshift 安全漏洞 | 8.0 | High | 2023-09-24 |
| CVE-2023-42793 | JetBrains TeamCity 安全漏洞 — TeamCity | 9.8 | Critical | 2023-09-19 |
| CVE-2023-4702 | Yepas Digital Yepas 访问控制错误漏洞 — Digital Yepas | 9.8 | Critical | 2023-09-14 |
| CVE-2023-41256 | Dover Fueling Solutions MAGLINK LX Console 安全漏洞 — MAGLINK LX Web Console Configuration | 9.1 | Critical | 2023-09-11 |
| CVE-2023-20269 | Cisco ASA和FTD 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 5.0 | Medium | 2023-09-06 |
| CVE-2023-3162 | WordPress plugin Stripe Payment Plugin for WooCommerce 安全漏洞 — Payment Gateway of Stripe for WooCommerce | 9.8 | Critical | 2023-08-31 |
| CVE-2023-3249 | WordPress Plugin Web3 – Crypto wallet Login & NFT token gating 安全漏洞 — Web3 – Crypto wallet Login & NFT token gating | 9.8 | Critical | 2023-06-30 |
| CVE-2023-2834 | WordPress Plugin BookIt 访问控制错误漏洞 — Bookit — Booking & Appointment Calendar | 9.8 | Critical | 2023-06-30 |
| CVE-2023-2982 | WordPress plugin Social Login and Register 安全漏洞 — miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) | 9.8 | Critical | 2023-06-29 |
| CVE-2023-34335 | BMC AMI 访问控制错误漏洞 — MegaRAC_SPx | 7.7 | High | 2023-06-12 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 546 条 CVE 漏洞。