CWE-940 通信信道源的不正确验证 类弱点 32 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-940属于通信源验证缺陷漏洞。攻击者通过建立来自不可信来源的通信通道，绕过身份验证机制，从而获取未授权访问权限或执行特权操作。开发者应在处理传入请求时，严格校验通信通道的来源，确保其符合预期信任域，并实施来源白名单或签名验证，以防止恶意实体伪造请求入口，保障系统交互的安全性。
IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType { NSURL *URL = [exRequest URL]; if ([[URL scheme] isEqualToString:@"exampleScheme"]) { NSString *functionString = [URL resourceSpecifier]; if ([functionString hasPrefix:@"specialFunction"]) { // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; } return NO; } return YES; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-4800 | memos 安全漏洞 — usememos/memos | 6.5 | - | 2022-12-28 |
| CVE-2021-41038 | Eclipse Theia 安全漏洞 — @theia/plugin-ext | 6.1 | - | 2021-11-10 |
CWE-940（通信信道源的不正确验证） 是常见的弱点类别，本平台收录该类弱点关联的 32 条 CVE 漏洞。