CWE-288 使用候选路径或通道进行的认证绕过 类弱点 546 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-27863 | D-Link DVA-2800 and DSL-2888A 授权问题漏洞 — Multiple Routers | 6.5 | - | 2021-02-11 |
| CVE-2020-13185 | Teradici Cloud Access Connector 安全漏洞 — - Cloud Access Connector - Cloud Access Connector Legacy | 7.5 | - | 2021-02-11 |
| CVE-2020-10048 | SIMATIC PCS 7 和 SIMATIC WinCC 授权问题漏洞 — SIMATIC PCS 7 | 7.1 | - | 2021-02-09 |
| CVE-2020-10148 | Solarwinds Orion Platform 授权问题漏洞 — Orion Platform | 9.8 | - | 2020-12-29 |
| CVE-2020-17409 | mini_httpd 安全漏洞 — Multiple Routers | 6.5 | - | 2020-10-13 |
| CVE-2020-10283 | Micro Air Vehicle Link 安全漏洞 — MAVLink | 9.8 | - | 2020-08-20 |
| CVE-2020-5384 | RSA MFA Agent 授权问题漏洞 — RSA Authentication Agent for Microsoft Windows | 8.4 | High | 2020-07-31 |
| CVE-2020-15633 | D-Link DIR-867和DIR-878 安全漏洞 — Multiple Routers | 8.8 | - | 2020-07-23 |
| CVE-2020-14485 | OpenClinic GA 授权问题漏洞 — OpenClinic GA | 9.8 | - | 2020-07-20 |
| CVE-2020-14477 | 多款Philips产品授权问题漏洞 — Ultrasound ClearVue | 3.6 | Low | 2020-06-26 |
| CVE-2020-4050 | WordPress 安全漏洞 — wordpress-develop | 3.5 | Low | 2020-06-12 |
| CVE-2020-6091 | 爱普生 EPSON EB-1470Ui 授权问题漏洞 — Epson | 7.5 | - | 2020-05-22 |
| CVE-2020-11005 | WindowsHello open source library 加密问题漏洞 — WindowsHello | 5.1 | Medium | 2020-04-14 |
| CVE-2020-1637 | Juniper Networks Junos OS on SRX Series 授权问题漏洞 — Junos OS | 7.2 | High | 2020-04-08 |
| CVE-2020-1618 | Juniper Networks Junos OS 授权问题漏洞 — Junos OS | 6.3 | Medium | 2020-04-08 |
| CVE-2019-5165 | Moxa AWK-3131A 授权问题漏洞 — Moxa | 7.2 | - | 2020-02-25 |
| CVE-2019-9510 | Microsoft Windows Server和Microsoft Windows 安全漏洞 — Windows 10 or newer system using RDP | 5.3 | Medium | 2020-01-15 |
| CVE-2019-5486 | GitLab 授权问题漏洞 — GitLab CE/EE | 9.8 | - | 2019-12-18 |
| CVE-2019-18250 | ABB Power Generation Information Manager和Plant Connect 授权问题漏洞 — ABB Power Generation Information Manager (PGIM) and Plant Connect All Versions | 8.1 | - | 2019-11-25 |
| CVE-2019-3758 | Dell EMC RSA Archer 授权问题漏洞 — RSA Archer | 9.8 | - | 2019-09-18 |
| CVE-2019-5473 | GitLab 授权问题漏洞 — gitlab.com | 7.2 | - | 2019-09-09 |
| CVE-2019-13526 | Datalogic AV7000 Linear Barcode Scanner 授权问题漏洞 — Datalogic AV7000 Linear barcode scanner | 9.8 | - | 2019-08-29 |
| CVE-2019-5451 | Nextcloud Android app 访问控制错误漏洞 — com.nextcloud.client | 4.6 | - | 2019-07-30 |
| CVE-2019-5453 | Nextcloud Android app 授权问题漏洞 — com.nextcloud.client | 6.1 | - | 2019-07-30 |
| CVE-2019-5455 | Nextcloud Android app 授权问题漏洞 — com.nextcloud.client | 6.8 | - | 2019-07-30 |
| CVE-2019-6551 | Pangea Communications Internet FAX ATA 授权问题漏洞 — Pangea Communications Internet FAX ATA | 7.5 | - | 2019-02-28 |
| CVE-2018-19000 | LCDS LAquis SCADA 授权问题漏洞 — LCDS Laquis SCADA | 7.5 | - | 2019-02-05 |
| CVE-2018-17918 | CIRCONTROL CirCarLife 授权问题漏洞 — Circontrol CirCarLife all versions prior to 4.3.1 | 9.8 | - | 2018-11-02 |
| CVE-2018-8859 | Echelon SmartServer 1、SmartServer 2和i.LON 100 安全漏洞 — SmartServer 1 | 9.8 | - | 2018-07-24 |
| CVE-2018-5386 | Navarino Infinity 信息泄露漏洞 — Infinity | 7.5 | - | 2018-07-24 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 546 条 CVE 漏洞。