CWE-288 使用候选路径或通道进行的认证绕过 类弱点 546 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-31022 | bleve 安全漏洞 — bleve | 6.2 | Medium | 2022-06-01 |
| CVE-2022-26865 | DELL SupportAssist OS Recovery 授权问题漏洞 — Dell OS Recovery Tool | 6.8 | Medium | 2022-05-26 |
| CVE-2021-32958 | Claroty Secure Remote Access 安全漏洞 — Secure Remote Access (SRA) Site | 5.5 | Medium | 2022-05-23 |
| CVE-2022-1681 | Wiki.js 授权问题漏洞 — requarks/wiki | 7.2 | - | 2022-05-12 |
| CVE-2021-31559 | Splunk Enterprise 授权问题漏洞 — Splunk Enterprise | 7.5 | High | 2022-05-06 |
| CVE-2022-23723 | Ping Identity PingFederate授权问题漏洞 — PingFederate PingOne MFA Integration Kit | 7.7 | High | 2022-05-02 |
| CVE-2022-23722 | Ping Identity PingFederate授权问题漏洞 — PingFederate | 6.5 | - | 2022-05-02 |
| CVE-2021-3897 | Lenovo Fan Power Controller2 授权问题漏洞 — Fan Power Controller2 (FPC2) | 9.8 | Critical | 2022-04-22 |
| CVE-2021-3849 | Lenovo Fan Power Controller2和Lenovo System Management Module 授权问题漏洞 — Fan Power Controller2 (FPC2) | 9.8 | Critical | 2022-04-22 |
| CVE-2022-0992 | WordPress plugin SiteGround Security 访问控制错误漏洞 — Security Optimizer – The All-In-One Protection Plugin | 9.8 | Critical | 2022-04-19 |
| CVE-2022-22189 | Juniper Networks Contrail Service Orchestration 安全漏洞 — Contrail Service Orchestration | 7.3 | High | 2022-04-14 |
| CVE-2022-1067 | LifePoint Informatics Patient Portal 授权问题漏洞 — Patient Portal | 6.5 | Medium | 2022-04-11 |
| CVE-2021-32986 | CLICK PLC CPU Modules 授权问题漏洞 — CLICK PLC CPU Modules: C0-1x CPUs | 9.8 | Critical | 2022-04-04 |
| CVE-2021-32984 | CLICK PLC CPU Modules 授权问题漏洞 — CLICK PLC CPU Modules: C0-1x CPUs | 9.8 | Critical | 2022-04-04 |
| CVE-2021-32980 | CLICK PLC CPU Modules 授权问题漏洞 — CLICK PLC CPU Modules: C0-1x CPUs | 9.8 | Critical | 2022-04-04 |
| CVE-2022-24813 | CreateWiki 授权问题漏洞 — CreateWiki | 5.3 | Medium | 2022-04-04 |
| CVE-2022-24047 | Track-It! 授权问题漏洞 — Track-It! | 9.8 | - | 2022-02-18 |
| CVE-2021-34977 | NETGEAR R7000 授权问题漏洞 — R7000 | 8.8 | - | 2022-01-13 |
| CVE-2021-33017 | Philips IntelliBridge EC80 Hub 安全漏洞 — IntelliBridge EC 40 Hub | 8.1 | High | 2021-12-27 |
| CVE-2021-43985 | mySCADA myPRO 安全漏洞 — myPRO | 9.1 | Critical | 2021-12-23 |
| CVE-2021-21952 | Eufy Anker Eufy Homebase 授权问题漏洞 — Anker" | 9.8 | - | 2021-12-22 |
| CVE-2021-27453 | MesaLabs AmegaView 安全漏洞 — AmegaView | 7.3 | High | 2021-12-21 |
| CVE-2021-43935 | Hillrom Welch Allyn CardioProducts 授权问题漏洞 — Welch Allyn Q-Stress Cardiac Stress Testing System | 8.1 | High | 2021-12-15 |
| CVE-2021-36308 | Dell Networking OS10 授权问题漏洞 — Networking OS | 5.9 | Medium | 2021-11-20 |
| CVE-2021-41292 | Ecoa Bas controller 授权问题漏洞 — ECS Router Controller ECS (FLASH) | 9.8 | Critical | 2021-09-30 |
| CVE-2021-33700 | SAP Business One 授权问题漏洞 — SAP Business One | 7.8 | - | 2021-09-15 |
| CVE-2021-32967 | Delta Electronics DIAEnergie 授权问题漏洞 — Delta Electronics DIAEnergie | 9.8 | - | 2021-08-30 |
| CVE-2021-28131 | Apache Impala 日志信息泄露漏洞 — Apache Impala | 8.8 | - | 2021-07-22 |
| CVE-2020-27865 | D-Link DAP-1860和TCP 授权问题漏洞 — DAP-1860 | 8.8 | - | 2021-02-11 |
| CVE-2020-27866 | 多款Netgear产品授权问题漏洞 — Multiple Routers | 8.8 | - | 2021-02-11 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 546 条 CVE 漏洞。