CWE-288 使用候选路径或通道进行的认证绕过 类弱点 495 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-27453 | MesaLabs AmegaView 安全漏洞 — AmegaView | 7.3 | High | 2021-12-21 |
| CVE-2021-43935 | Hillrom Welch Allyn CardioProducts 授权问题漏洞 — Welch Allyn Q-Stress Cardiac Stress Testing System | 8.1 | High | 2021-12-15 |
| CVE-2021-36308 | Dell Networking OS10 授权问题漏洞 — Networking OS | 5.9 | Medium | 2021-11-20 |
| CVE-2021-41292 | Ecoa Bas controller 授权问题漏洞 — ECS Router Controller ECS (FLASH) | 9.8 | Critical | 2021-09-30 |
| CVE-2021-33700 | SAP Business One 授权问题漏洞 — SAP Business One | 7.8 | - | 2021-09-15 |
| CVE-2021-32967 | Delta Electronics DIAEnergie 授权问题漏洞 — Delta Electronics DIAEnergie | 9.8 | - | 2021-08-30 |
| CVE-2021-28131 | Apache Impala 日志信息泄露漏洞 — Apache Impala | 8.8 | - | 2021-07-22 |
| CVE-2020-27865 | D-Link DAP-1860和TCP 授权问题漏洞 — DAP-1860 | 8.8 | - | 2021-02-11 |
| CVE-2020-27866 | 多款Netgear产品授权问题漏洞 — Multiple Routers | 8.8 | - | 2021-02-11 |
| CVE-2020-27863 | D-Link DVA-2800 and DSL-2888A 授权问题漏洞 — Multiple Routers | 6.5 | - | 2021-02-11 |
| CVE-2020-13185 | Teradici Cloud Access Connector 安全漏洞 — - Cloud Access Connector - Cloud Access Connector Legacy | 7.5 | - | 2021-02-11 |
| CVE-2020-10048 | SIMATIC PCS 7 和 SIMATIC WinCC 授权问题漏洞 — SIMATIC PCS 7 | 7.1 | - | 2021-02-09 |
| CVE-2020-10148 | Solarwinds Orion Platform 授权问题漏洞 — Orion Platform | 9.8 | - | 2020-12-29 |
| CVE-2020-17409 | mini_httpd 安全漏洞 — Multiple Routers | 6.5 | - | 2020-10-13 |
| CVE-2020-10283 | Micro Air Vehicle Link 安全漏洞 — MAVLink | 9.8 | - | 2020-08-20 |
| CVE-2020-5384 | RSA MFA Agent 授权问题漏洞 — RSA Authentication Agent for Microsoft Windows | 8.4 | High | 2020-07-31 |
| CVE-2020-15633 | D-Link DIR-867和DIR-878 安全漏洞 — Multiple Routers | 8.8 | - | 2020-07-23 |
| CVE-2020-14485 | OpenClinic GA 授权问题漏洞 — OpenClinic GA | 9.8 | - | 2020-07-20 |
| CVE-2020-14477 | 多款Philips产品授权问题漏洞 — Ultrasound ClearVue | 3.6 | Low | 2020-06-26 |
| CVE-2020-4050 | WordPress 安全漏洞 — wordpress-develop | 3.5 | Low | 2020-06-12 |
| CVE-2020-6091 | 爱普生 EPSON EB-1470Ui 授权问题漏洞 — Epson | 7.5 | - | 2020-05-22 |
| CVE-2020-11005 | WindowsHello open source library 加密问题漏洞 — WindowsHello | 5.1 | Medium | 2020-04-14 |
| CVE-2020-1637 | Juniper Networks Junos OS on SRX Series 授权问题漏洞 — Junos OS | 7.2 | High | 2020-04-08 |
| CVE-2020-1618 | Juniper Networks Junos OS 授权问题漏洞 — Junos OS | 6.3 | Medium | 2020-04-08 |
| CVE-2019-5165 | Moxa AWK-3131A 授权问题漏洞 — Moxa | 7.2 | - | 2020-02-25 |
| CVE-2019-9510 | Microsoft Windows Server和Microsoft Windows 安全漏洞 — Windows 10 or newer system using RDP | 5.3 | Medium | 2020-01-15 |
| CVE-2019-5486 | GitLab 授权问题漏洞 — GitLab CE/EE | 9.8 | - | 2019-12-18 |
| CVE-2019-18250 | ABB Power Generation Information Manager和Plant Connect 授权问题漏洞 — ABB Power Generation Information Manager (PGIM) and Plant Connect All Versions | 8.1 | - | 2019-11-25 |
| CVE-2019-3758 | Dell EMC RSA Archer 授权问题漏洞 — RSA Archer | 9.8 | - | 2019-09-18 |
| CVE-2019-5473 | GitLab 授权问题漏洞 — gitlab.com | 7.2 | - | 2019-09-09 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 495 条 CVE 漏洞。