CWE-441 未有动机的代理或中间人(混淆代理) 类弱点 96 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-441 属于身份混淆漏洞，指系统在转发请求时未保留原始来源信息，导致其伪装成请求发起者。攻击者常利用此缺陷，通过中间系统间接执行特权操作，从而绕过访问控制。开发者应避免此问题，确保在跨边界通信时严格验证并传递原始身份标识，实施最小权限原则，防止系统被误用为不受控的代理。
The code in ring-3 (least trusted ring) of the
microcontroller attempts to directly read the protected
registers in IP core through MMIO transactions. However,
this attempt is blocked due to the implemented access
control. Now, the microcontroller configures the DMA core
to transfer data from the protected registers to a memory
region that it has access to. The DMA core, which is
acting as an intermediary in this transaction, does not
The DMA
core forwards this transaction with the identity of the
code executing on the microcontroller, which is the
original initiator of the end-to-end transaction. Now the
transaction is blocked, as a result of forwarding the
identity of the true initiator which lacks the permission
to access the confidential MMIO mapped IP core.CWE-441（未有动机的代理或中间人(混淆代理)） 是常见的弱点类别，本平台收录该类弱点关联的 96 条 CVE 漏洞。