目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-295 证书验证不恰当 类漏洞列表 675

CWE-295 证书验证不恰当 类弱点 675 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。

MITRE CWE 官方描述
CWE：CWE-295 证书验证不当 英文：产品未对证书进行验证，或验证不正确。
常见影响 (1)
Integrity, Authentication Bypass Protection Mechanism, Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting s…
缓解措施 (2)
Architecture and Design, Implementation Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
代码示例 (2)
This code checks the certificate of a connected peer.
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trusted
Bad · C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2020-7924 Mongodb Server 信任管理问题漏洞 — MongoDB Database Tools 4.2 Medium 2021-04-12
CVE-2021-22511 Jenkins 信任管理问题漏洞 — Micro Focus Application Automation Tools Plugin - Jenkins plugin. 5.3 - 2021-04-08
CVE-2021-21385 Garvit Agarwal mifos-mobile 安全漏洞 — mifos-mobile 8.8 High 2021-03-24
CVE-2021-27257 Netgear NETGEAR R7800 信任管理问题漏洞 — R7800 8.1 - 2021-03-05
CVE-2021-20328 MongoDB 信任管理问题漏洞 — mongo-java-driver 6.4 Medium 2021-02-25
CVE-2021-20327 mongodb-client-encryption 信任管理问题漏洞 — MongoDB Node.js Driver mongodb-client-encryption module 6.4 Medium 2021-02-25
CVE-2021-20230 Stunnel 信任管理问题漏洞 — stunnel 7.5 - 2021-02-23
CVE-2021-1354 Cisco UCS Central 信任管理问题漏洞 — Cisco Unified Computing System Central Software 4.3 Medium 2021-02-04
CVE-2021-1276 Cisco Data Center Network Manager 信任管理问题漏洞 — Cisco Data Center Network Manager 7.5 High 2021-01-20
CVE-2021-1277 Cisco Data Center Network Manager 信任管理问题漏洞 — Cisco Data Center Network Manager 7.5 High 2021-01-20
CVE-2020-25680 Apache httpd 信任管理问题漏洞 — JBCS httpd 7.1 - 2021-01-07
CVE-2020-8289 Backblaze 信任管理问题漏洞 — Backblaze 8.8 - 2020-12-27
CVE-2020-8286 HAXX libcurl 信任管理问题漏洞 — https://github.com/curl/curl 5.3 - 2020-12-14
CVE-2012-0955 Launchpad Software-properties 信任管理问题漏洞 — software-properties 6.8 Medium 2020-12-02
CVE-2020-8279 Nextcloud 信任管理问题漏洞 — Nextcloud Social 7.4 - 2020-11-19
CVE-2020-27648 Synology DiskStation Manager 信任管理问题漏洞 — DiskStation Manager (DSM) 8.3 High 2020-10-29
CVE-2020-27649 Synology Router Manager 信任管理问题漏洞 — Synology Router Manager (SRM) 8.3 High 2020-10-29
CVE-2020-3557 Cisco Firepower Management Center 信任管理问题漏洞 — Cisco Firepower Management Center 5.3 Medium 2020-10-21
CVE-2020-6781 Bosch Smart Home System App 信任管理问题漏洞 — Smart Home 6.8 Medium 2020-09-16
CVE-2018-19946 QNAP Systems TS-870 安全漏洞 — Helpdesk 4.2 Medium 2020-09-11
CVE-2020-15133 faye-websocket 信任管理问题漏洞 — faye-websocket 8.0 High 2020-07-31
CVE-2020-15134 Faye 信任管理问题漏洞 — faye 8.0 High 2020-07-31
CVE-2020-10925 NETGEAR R6700 信任管理问题漏洞 — R6700 8.1 - 2020-07-28
CVE-2020-5367 Dell EMC Unisphere for PowerMax 信任管理问题漏洞 — Unisphere for PowerMax, Unisphere for PowerMax Virtual Appliance, PowerMax OS 7.4 High 2020-06-23
CVE-2020-3342 Cisco Webex Meetings Desktop App 信任管理问题漏洞 — Cisco WebEx Meetings Server 8.8 - 2020-06-18
CVE-2020-8156 Nextcloud Mail 信任管理问题漏洞 — Nextcloud Mail 7.0 - 2020-05-12
CVE-2020-10059 Zephyr 信任管理问题漏洞 — zephyr 4.8 Medium 2020-05-11
CVE-2020-12144 多款Silver Peak Systems产品信任管理问题漏洞 — 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator  3. EdgeConnect in AWS, Azure, GCP 6.0 Medium 2020-05-05
CVE-2020-12143 多款Silver Peak产品信任管理问题漏洞 — 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator,   3. EdgeConnect in AWS, Azure, GCP 6.0 Medium 2020-05-05
CVE-2020-7922 MongoDB 多款产品信任管理问题漏洞 — MongoDB Enterprise Kubernetes Operator 6.4 Medium 2020-04-09

CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 675 条 CVE 漏洞。