目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-565 在信任Cookie未进行验证与完整性检查 类漏洞列表 32

CWE-565 在信任Cookie未进行验证与完整性检查 类弱点 32 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-565 属于依赖不可信数据的安全漏洞。攻击者通过篡改或伪造 Cookie 值，诱导系统在未验证身份或完整性的情况下执行关键操作，从而绕过认证或实施越权访问。开发者应避免直接信任 Cookie 数据，需结合服务端会话管理、签名校验及完整性检查机制，确保数据源可信，防止恶意输入影响安全逻辑。

MITRE CWE 官方描述
CWE：CWE-565 依赖 Cookie 而未进行验证和完整性检查 英文：该产品在执行安全关键操作时依赖于 Cookie 的存在或其值，但未正确确保该设置对于关联用户是有效的。
常见影响 (2)
Confidentiality, Integrity, Availability Modify Application Data, Execute Unauthorized Code or Commands
Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Reliance on cookies without detailed validation and integrity checking can allow attackers to bypass authentication, conduct injection attacks such as SQL injection and cross-site …
Access Control Gain Privileges or Assume Identity
It is dangerous to use cookies to set a user's privileges. The cookie can be manipulated to escalate an attacker's privileges to an administrative level.
缓解措施 (4)
Architecture and Design Avoid using cookie data for a security-related decision.
Implementation Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
Architecture and Design Add integrity checks to detect tampering.
Architecture and Design Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, s…
代码示例 (1)
The following code excerpt reads a value from a browser cookie to determine the role of the user.
Cookie[] cookies = request.getCookies(); for (int i =0; i< cookies.length; i++) { Cookie c = cookies[i]; if (c.getName().equals("role")) { userRole = c.getValue(); } }
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2020-15128 October CMS 加密问题漏洞 — october 6.1 Medium 2020-07-31
CVE-2018-5455 Moxa OnCell G3100-HSPA Series 安全漏洞 — Moxa OnCell G3100-HSPA Series 9.8 - 2018-03-05

CWE-565（在信任Cookie未进行验证与完整性检查） 是常见的弱点类别，本平台收录该类弱点关联的 32 条 CVE 漏洞。