目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1325 元

100%
请我们喝杯咖啡

CWE-298 证书过期验证不恰当 类漏洞列表 4

CWE-298 证书过期验证不恰当 类弱点 4 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-298 属于证书过期验证不当漏洞，指系统未正确检查数字证书的有效性期限。攻击者常利用已过期或即将过期的证书进行中间人攻击，伪装成合法服务以窃取敏感数据或实施欺诈。开发者应确保在建立安全连接时严格验证证书的有效期，及时更新受信任的证书库，并配置合理的超时与错误处理机制，从而防止系统接受无效凭证。

MITRE CWE 官方描述
CWE：CWE-298 证书过期验证不当 (Improper Validation of Certificate Expiration) 英文：未对证书过期进行验证，或验证不正确。
常见影响 (2)
Integrity, OtherOther
The data read from the system vouched for by the expired certificate may be flawed due to malicious spoofing.
Authentication, OtherOther
Trust may be assigned to certificates that have been abandoned due to age.
缓解措施 (2)
Architecture and DesignCheck for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.
ImplementationIf certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the expiration.
代码示例 (1)
The following OpenSSL code ensures that there is a certificate and allows the use of expired certificates.
if (cert = SSL_get_peer(certificate(ssl)) { foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || (X509_V_ERR_CERT_HAS_EXPIRED==foo)) //do stuff
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2025-61736 Johnson Controls iSTAR series 安全漏洞 — iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE 5.3AIMediumAI2025-12-17
CVE-2025-59036 OpsMill Infrahub 安全漏洞 — infrahub 5.5 Medium2025-09-09
CVE-2025-4384 PcVue 安全漏洞 — PcVue 7.5AIHighAI2025-05-06
CVE-2023-42446 Pow 安全漏洞 — pow 6.5 Medium2023-09-18

CWE-298（证书过期验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 4 条 CVE 漏洞。