目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-290 使用欺骗进行的认证绕过 类漏洞列表 259

CWE-290 使用欺骗进行的认证绕过 类弱点 259 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-290 是一种身份验证绕过漏洞，源于身份验证机制实现不当，易受欺骗攻击。攻击者通常通过伪造或篡改身份标识（如IP地址、证书或令牌），使系统误认其为合法用户从而获取未授权访问权限。开发者应实施强身份验证策略，包括多因素认证、严格的输入验证及防重放机制，并定期审查认证逻辑，确保身份源的可信性与完整性，以有效防御此类欺骗行为。

MITRE CWE 官方描述
CWE：CWE-290 通过欺骗绕过身份验证 (Authentication Bypass by Spoofing) 英文：这种以攻击为导向的弱点是由错误实现的身份验证方案引起的，这些方案容易受到欺骗攻击 (spoofing attacks)。
常见影响 (1)
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
代码示例 (2)
The following code authenticates users.
String sourceIP = request.getRemoteAddr(); if (sourceIP != null && sourceIP.equals(APPROVED_IP)) { authenticated = true; }
Bad · Java
Both of these examples check if a request is from a trusted address before responding to the request.
sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET; serv.sin_addr.s_addr = htonl(INADDR_ANY); servr.sin_port = htons(1008); bind(sd, (struct sockaddr *) & serv, sizeof(serv)); while (1) { memset(msg, 0x0, MAX_MSG); clilen = sizeof(cli); if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) { n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen); } }
Bad · C
while(true) { DatagramPacket rp=new DatagramPacket(rData,rData.length); outSock.receive(rp); String in = new String(p.getData(),0, rp.getLength()); InetAddress clientIPAddress = rp.getAddress(); int port = rp.getPort(); if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) { out = secret.getBytes(); DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp); } }
Bad · Java
CVE ID标题CVSS风险等级Published
CVE-2023-41133 WordPress plugin Secure Admin IP 安全漏洞 — Secure Admin IP 5.3 Medium2024-12-13
CVE-2024-50380 Snap One OvrC 安全漏洞 — OVRC cloud 8.2 -2024-12-02
CVE-2024-36466 Zabbix 安全漏洞 — Zabbix 8.8 High2024-11-28
CVE-2024-8935 Schneider Electric Modicon M340 安全漏洞 — Modicon M340 CPU (part numbers BMXP34*) 7.5 High2024-11-13
CVE-2024-51504 Apache Zookeeper 安全漏洞 — Apache ZooKeeper 9.1AICriticalAI2024-11-07
CVE-2024-20384 Cisco Firepower Threat Defense和Cisco Adaptive Security Appliance 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software 5.8 Medium2024-10-23
CVE-2024-20299 Cisco Firepower Threat Defense和Cisco Adaptive Security Appliance 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software 5.8 Medium2024-10-23
CVE-2024-20297 Cisco Firepower Threat Defense和Cisco Adaptive Security Appliance 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software 5.8 Medium2024-10-23
CVE-2024-10125 Amazon.ApplicationLoadBalancer.Identity.AspNetCore 安全漏洞 — Amazon.ApplicationLoadBalancer.Identity.AspNetCore Middleware 7.5 High2024-10-21
CVE-2024-8901 AWS ALB Route Directive Adapter For Istio 安全漏洞 — AWS ALB Route Directive Adapter For Istio 7.5 High2024-10-21
CVE-2024-45453 WordPress plugin Maintenance Redirect 安全漏洞 — Maintenance Redirect 3.7 Low2024-09-23
CVE-2024-6678 GitLab 安全漏洞 — GitLab 9.9 Critical2024-09-12
CVE-2024-44104 Ivanti Workspace Control 安全漏洞 — Workspace Control 8.8 High2024-09-10
CVE-2024-43944 WordPress plugin Maintenance & Coming Soon Redirect Animation 安全漏洞 — Maintenance & Coming Soon Redirect Animation 3.7 Low2024-08-29
CVE-2023-48396 Apache SeaTunnel 安全漏洞 — Apache SeaTunnel Web 9.8AICriticalAI2024-07-30
CVE-2024-41107 Apache CloudStack 安全漏洞 — Apache CloudStack 9.8 -2024-07-19
CVE-2023-40356 PingOne MFA Integration Kit 2.3.1 安全漏洞 — PingOne MFA Integration Kit for PingFederate 5.3AIMediumAI2024-07-09
CVE-2023-40702 Ping Identity PingFederate PingOne MFA Integration Kit 安全漏洞 — PingOne MFA Integration Kit for PingFederate 8.1AIHighAI2024-07-09
CVE-2024-37430 WordPress plugin Patreon WordPress 安全漏洞 — Patreon WordPress 5.3 Medium2024-07-09
CVE-2024-6163 Checkmk 安全漏洞 — Checkmk 5.3 Medium2024-07-08
CVE-2024-37082 Cloud Foundry 安全漏洞 — haproxy-boshrelease 9.1 Critical2024-07-03
CVE-2024-39350 Synology Camera Firmware 安全漏洞 — Camera Firmware 7.5 High2024-06-28
CVE-2024-5812 BeyondInsight 安全漏洞 — BeyondInsight PasswordSafe 3.3 Low2024-06-11
CVE-2024-35749 WordPress plugin Under Construction / Maintenance Mode from Acurax 安全漏洞 — Under Construction / Maintenance Mode from Acurax 3.7 Low2024-06-10
CVE-2024-5037 Red Hat OpenShift Telemeter 安全漏洞 7.5 High2024-06-05
CVE-2023-52176 WordPress plugin Malware Scanner 安全漏洞 — Malware Scanner 5.3 Medium2024-06-04
CVE-2023-51667 WordPress plugin Rate my Post – WP Rating System 安全漏洞 — Rate my Post – WP Rating System 5.3 Medium2024-06-04
CVE-2023-51543 WordPress plugin RegistrationMagic 安全漏洞 — RegistrationMagic 5.3 Medium2024-06-04
CVE-2023-51542 WordPress plugin Branda 安全漏洞 — Branda 5.3 Medium2024-06-04
CVE-2023-49741 WordPress plugin Coming soon and Maintenance mode 安全漏洞 — Coming soon and Maintenance mode 3.7 Low2024-06-04

CWE-290（使用欺骗进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 259 条 CVE 漏洞。