CWE-290 使用欺骗进行的认证绕过 类弱点 401 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-290 是一种身份验证绕过漏洞，源于身份验证机制实现不当，易受欺骗攻击。攻击者通常通过伪造或篡改身份标识（如IP地址、证书或令牌），使系统误认其为合法用户从而获取未授权访问权限。开发者应实施强身份验证策略，包括多因素认证、严格的输入验证及防重放机制，并定期审查认证逻辑，确保身份源的可信性与完整性，以有效防御此类欺骗行为。
String sourceIP = request.getRemoteAddr(); if (sourceIP != null && sourceIP.equals(APPROVED_IP)) { authenticated = true; }sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET; serv.sin_addr.s_addr = htonl(INADDR_ANY); servr.sin_port = htons(1008); bind(sd, (struct sockaddr *) & serv, sizeof(serv)); while (1) { memset(msg, 0x0, MAX_MSG); clilen = sizeof(cli); if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) { n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen); } }while(true) { DatagramPacket rp=new DatagramPacket(rData,rData.length); outSock.receive(rp); String in = new String(p.getData(),0, rp.getLength()); InetAddress clientIPAddress = rp.getAddress(); int port = rp.getPort(); if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) { out = secret.getBytes(); DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp); } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-39227 | python-jwt 安全漏洞 — python-jwt | 9.1 | Critical | 2022-09-23 |
| CVE-2022-23949 | Keylime 安全漏洞 — keylime | 7.5 | - | 2022-09-21 |
| CVE-2021-43310 | Keylime 安全漏洞 — keylime | 9.8 | - | 2022-09-21 |
| CVE-2022-35957 | Grafana 安全漏洞 — grafana | 6.6 | Medium | 2022-09-20 |
| CVE-2022-31149 | ActivityWatch 安全漏洞 — activitywatch | 8.8 | High | 2022-09-07 |
| CVE-2022-32744 | Samba 权限许可和访问控制问题漏洞 — samba | 8.8 | - | 2022-08-25 |
| CVE-2022-2310 | McAfee Skyhigh Secure Web Gateway 安全漏洞 — Skyhigh Secure Web Gateway (SWG) | 10.0 | Critical | 2022-07-27 |
| CVE-2022-2368 | Microweber 安全漏洞 — microweber/microweber | 6.5 | Medium | 2022-07-11 |
| CVE-2022-1745 | Dominion Voting Systems ImageCast X 安全漏洞 — ImageCast X application | 6.8 | - | 2022-06-24 |
| CVE-2022-25989 | Eufy Anker Eufy Homebase 安全漏洞 — Eufy Homebase 2 | 8.8 | - | 2022-05-05 |
| CVE-2022-24858 | next-auth 输入验证错误漏洞 — next-auth | 6.1 | Medium | 2022-04-19 |
| CVE-2022-24112 | Apache APISIX 安全漏洞 — Apache APISIX | 9.8 | - | 2022-02-11 |
| CVE-2022-23131 | Zabbix 安全漏洞 — Frontend | 9.1 | Critical | 2022-01-13 |
| CVE-2021-43807 | Opencast 安全漏洞 — opencast | 7.5 | High | 2021-12-14 |
| CVE-2021-41130 | Extensible Service Proxy 安全漏洞 — esp | 6.4 | Medium | 2021-10-07 |
| CVE-2021-34646 | Wordpress plugin Booster for WooCommerce 安全特征问题漏洞 — Booster for WooCommcerce | 9.8 | Critical | 2021-08-30 |
| CVE-2021-32076 | SolarWinds Web Help Desk 安全漏洞 — Web Help Desk | 5.3 | Medium | 2021-08-26 |
| CVE-2021-32631 | Common 安全漏洞 — common | 6.5 | Medium | 2021-07-26 |
| CVE-2020-7388 | Sage Group Sage X3 安全漏洞 — X3 | 10.0 | Critical | 2021-07-22 |
| CVE-2021-22779 | Schneider Electric EcoStruxure Control Expert 安全漏洞 — EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*) | 9.1 | - | 2021-07-14 |
| CVE-2021-28810 | Roon 安全漏洞 — Roon Server | 7.5 | High | 2021-06-08 |
| CVE-2021-20278 | Kiali 授权问题漏洞 — kiali | 9.8 | - | 2021-05-28 |
| CVE-2020-13529 | systemd 安全漏洞 — Systemd | 6.1 | - | 2021-05-10 |
| CVE-2021-29441 | Nacos 安全漏洞 — nacos | 8.6 | High | 2021-04-27 |
| CVE-2021-21492 | SAP NetWeaver Application Server Java 安全漏洞 — SAP NetWeaver AS for JAVA (HTTP Service) | 5.3 | - | 2021-04-13 |
| CVE-2021-21310 | NextAuth.js 安全漏洞 — next-auth | 6.1 | Medium | 2021-02-11 |
| CVE-2020-17516 | Apache Cassandra 安全漏洞 — Apache Cassandra | 7.5 | - | 2021-02-03 |
| CVE-2020-27276 | 多款Sooil产品授权问题漏洞 — SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A | 5.7 | - | 2021-01-19 |
| CVE-2020-26276 | Fleet 授权问题漏洞 — fleet | 10.0 | Critical | 2020-12-17 |
| CVE-2020-26254 | omniautho-apple 安全漏洞 — omniauth-apple | 7.7 | High | 2020-12-08 |
CWE-290（使用欺骗进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 401 条 CVE 漏洞。