CWE-290 使用欺骗进行的认证绕过 类弱点 336 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-290 是一种身份验证绕过漏洞，源于身份验证机制实现不当，易受欺骗攻击。攻击者通常通过伪造或篡改身份标识（如IP地址、证书或令牌），使系统误认其为合法用户从而获取未授权访问权限。开发者应实施强身份验证策略，包括多因素认证、严格的输入验证及防重放机制，并定期审查认证逻辑，确保身份源的可信性与完整性，以有效防御此类欺骗行为。
String sourceIP = request.getRemoteAddr(); if (sourceIP != null && sourceIP.equals(APPROVED_IP)) { authenticated = true; }sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET; serv.sin_addr.s_addr = htonl(INADDR_ANY); servr.sin_port = htons(1008); bind(sd, (struct sockaddr *) & serv, sizeof(serv)); while (1) { memset(msg, 0x0, MAX_MSG); clilen = sizeof(cli); if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) { n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen); } }while(true) { DatagramPacket rp=new DatagramPacket(rData,rData.length); outSock.receive(rp); String in = new String(p.getData(),0, rp.getLength()); InetAddress clientIPAddress = rp.getAddress(); int port = rp.getPort(); if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) { out = secret.getBytes(); DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp); } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-25906 | WordPress plugin Comments Like Dislike 安全漏洞 — Comments Like Dislike | 4.3 | Medium | 2024-05-17 |
| CVE-2024-30479 | WordPress plugin IP Blocker Lite 安全漏洞 — IP Blocker Lite | 5.3 | Medium | 2024-05-17 |
| CVE-2024-30480 | WordPress plugin CGC Maintenance Mode 安全漏洞 — CGC Maintenance Mode | 3.7 | Low | 2024-05-17 |
| CVE-2024-30522 | WordPress plugin Newsletter 安全漏洞 — Newsletter | 5.3 | Medium | 2024-05-17 |
| CVE-2024-33917 | WordPress plugin WTI Like Post 安全漏洞 — WTI Like Post | 5.3 | Medium | 2024-05-17 |
| CVE-2024-32977 | OctoPrint 安全漏洞 — OctoPrint | 7.1 | High | 2024-05-14 |
| CVE-2023-50224 | TP-LINK TL-WR841N 安全漏洞 — TL-WR841N | 6.5 | - | 2024-05-03 |
| CVE-2023-44447 | TP-LINK TL-WR902AC 安全漏洞 — TL-WR902AC | 6.5 | - | 2024-05-03 |
| CVE-2024-1347 | GitLab CE/EE 安全漏洞 — GitLab | 4.3 | Medium | 2024-04-25 |
| CVE-2024-27349 | Apache HugeGraph 安全漏洞 — Apache HugeGraph-Server | 9.1 | - | 2024-04-22 |
| CVE-2024-31863 | Apache Zeppelin 安全漏洞 — Apache Zeppelin | 9.1AI | Critical AI | 2024-04-09 |
| CVE-2024-30191 | Siemens SCALANCE W700产品系列安全漏洞 — SCALANCE W1748-1 M12 | 8.4 | High | 2024-04-09 |
| CVE-2024-30190 | Siemens SCALANCE W700产品系列安全漏洞 — SCALANCE W1748-1 M12 | 6.1 | Medium | 2024-04-09 |
| CVE-2024-30189 | Siemens SCALANCE W700产品系列安全漏洞 — SCALANCE W721-1 RJ45 | 6.1 | Medium | 2024-04-09 |
| CVE-2024-29006 | Apache CloudStack 安全漏洞 — Apache CloudStack | 8.1 | - | 2024-04-04 |
| CVE-2024-22092 | OpenHarmony 安全漏洞 — OpenHarmony | 7.7 | High | 2024-04-02 |
| CVE-2024-28228 | JetBrains YouTrack 安全漏洞 — YouTrack | 5.3 | Medium | 2024-03-07 |
| CVE-2024-22457 | Dell Secure Connect Gateway 安全漏洞 — Secure Connect Gateway (SCG) 5.0 Appliance - SRS | 7.1 | High | 2024-03-01 |
| CVE-2024-21494 | Caddy 安全漏洞 — github.com/greenpau/caddy-security | 5.4 | Medium | 2024-02-17 |
| CVE-2023-7169 | Snow Software Inventory Agent 安全漏洞 — Snow Inventory Agent | 6.0 | Medium | 2024-02-08 |
| CVE-2024-23832 | Mastodon 安全漏洞 — mastodon | 9.4 | Critical | 2024-02-01 |
| CVE-2023-6044 | Lenovo Vantage 安全漏洞 — Vantage | 6.3 | Medium | 2024-01-19 |
| CVE-2023-44117 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 7.5AI | High AI | 2024-01-16 |
| CVE-2023-4566 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 7.5AI | High AI | 2024-01-16 |
| CVE-2023-4001 | grub2 安全漏洞 — Red Hat Enterprise Linux 9 | 6.8 | Medium | 2024-01-15 |
| CVE-2024-0454 | Dell EMC ELAN Match-on-Chip FPR solution 安全漏洞 — DELL Inspiron | 6.0 | Medium | 2024-01-12 |
| CVE-2023-49794 | KernelSU 安全漏洞 — KernelSU | 6.7 | Medium | 2024-01-02 |
| CVE-2023-6263 | Network Optix NxCloud 安全漏洞 — NxCloud | 8.3 | High | 2023-11-22 |
| CVE-2023-3103 | Unitree Robotics A1 安全漏洞 — A1 | 8.0 | High | 2023-11-22 |
| CVE-2023-5801 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 9.1 | - | 2023-11-08 |
CWE-290（使用欺骗进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 336 条 CVE 漏洞。