目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-295 证书验证不恰当 类漏洞列表 675

CWE-295 证书验证不恰当 类弱点 675 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。

MITRE CWE 官方描述
CWE：CWE-295 证书验证不当 英文：产品未对证书进行验证，或验证不正确。
常见影响 (1)
Integrity, Authentication Bypass Protection Mechanism, Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting s…
缓解措施 (2)
Architecture and Design, Implementation Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
代码示例 (2)
This code checks the certificate of a connected peer.
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trusted
Bad · C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2022-24320 EcoStruxure Geo SCADA Expert 信任管理问题漏洞 — ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) 5.9 - 2022-02-09
CVE-2022-24319 EcoStruxure Geo SCADA Expert 信任管理问题漏洞 — ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) 5.9 - 2022-02-09
CVE-2021-21959 Sealevel Systems SeaConnect 370W 信任管理问题漏洞 — Sealevel 8.1 - 2022-02-04
CVE-2021-44549 Apache Sling Commons Messaging Mail 信任管理问题漏洞 — Apache Sling Commons Messaging Mail 7.4 - 2021-12-14
CVE-2021-42027 Siemens SINUMERIK 信任管理问题漏洞 — SINUMERIK Edge 7.4 - 2021-12-14
CVE-2021-34599 CODESYS 信任管理问题漏洞 — CODESYS Git 7.4 High 2021-12-01
CVE-2021-23167 Gallagher Command Centre Server信任管理问题漏洞 — Command Centre 8.1 High 2021-11-18
CVE-2021-26320 AMD Platform Security Processor信任管理问题漏洞 — 1st Gen AMD EPYC™ 5.5 - 2021-11-16
CVE-2021-22278 Abb Pcm600信任管理问题漏洞 — PCM600 6.7 Medium 2021-10-28
CVE-2021-25634 LibreOffice 信任管理问题漏洞 — LibreOffice 7.5 - 2021-10-12
CVE-2021-25633 LibreOffice 信任管理问题漏洞 — LibreOffice 7.5 - 2021-10-11
CVE-2021-40713 Adobe Experience Manager 信任管理问题漏洞 — Experience Manager 5.9 Medium 2021-09-27
CVE-2021-37698 Icinga 信任管理问题漏洞 — icinga2 7.5 High 2021-08-19
CVE-2021-32728 Nextcloud Desktop Client 信任管理问题漏洞 — security-advisories 6.5 Medium 2021-08-18
CVE-2021-22939 node core 信任管理问题漏洞 — Node 5.3 - 2021-08-16
CVE-2021-3636 Red Hat OpenShift 授权问题漏洞 — openshift 4.6 - 2021-07-30
CVE-2021-32755 Wire 信任管理问题漏洞 — wire-ios-transport 5.4 Medium 2021-07-13
CVE-2021-31892 Siemens SINUMERIK 信任管理问题漏洞 — SINUMERIK Analyse MyCondition 7.4 - 2021-07-13
CVE-2021-32727 Nextcloud 信任管理问题漏洞 — security-advisories 5.7 Medium 2021-07-12
CVE-2021-1134 Cisco DNA Center 信任管理问题漏洞 — Cisco Digital Network Architecture Center (DNA Center) 9.1 - 2021-06-29
CVE-2021-21571 Dell BIOSConnect信任管理问题漏洞 — UEFI BIOS https stack 5.9 Medium 2021-06-24
CVE-2020-15732 Bitdefender 多款产品信任管理问题漏洞 — Total Security 6.5 Medium 2021-06-22
CVE-2021-22895 Nextcloud 信任管理问题漏洞 — Nextcloud Desktop Client 5.9 - 2021-06-11
CVE-2021-21559 Dell EMC NetWorker 信任管理问题漏洞 — NetWorker 7.1 High 2021-06-08
CVE-2021-29504 WordPress 插件信任管理问题漏洞 — wp-cli 9.1 Critical 2021-06-07
CVE-2007-5967 Mozilla 信任管理问题漏洞 — Mozilla Firefox 8.1 - 2021-05-17
CVE-2021-22138 Elasticsearch Logstash 信任管理问题漏洞 — Elasticsearch 3.7 - 2021-05-13
CVE-2021-29495 Nim 信任管理问题漏洞 — security 5.9 Medium 2021-05-07
CVE-2021-20989 FIBARO Home Center 2 信任管理问题漏洞 — Fibaro Home Center 5.9 Medium 2021-04-19
CVE-2021-3460 Motorola MH702 信任管理问题漏洞 — MH702x 8.1 High 2021-04-13

CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 675 条 CVE 漏洞。