CWE-804 可猜测的验证码

Guessable CAPTCHA

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

扩展描述

An automated attacker could bypass the intended protection of the CAPTCHA challenge and perform actions at a higher frequency than humanly possible, such as launching spam attacks.

There can be several different causes of a guessable CAPTCHA:

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 863 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 863 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699

• cwe_Nature: ChildOf cwe_CWE_ID: 330 cwe_View_ID: 1000

• cwe_Nature: ChildOf cwe_CWE_ID: 330 cwe_View_ID: 699

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

Technology: {'cwe_Name': 'Web Server', 'cwe_Prevalence': 'Sometimes'}

常见的影响

范围	影响	注释
['Access Control', 'Other']	['Bypass Protection Mechanism', 'Other']	When authorization, authentication, or another protection mechanism relies on CAPTCHA entities to ensure that only human actors can access certain functionality, then an automated attacker such as a bot may access the restricted functionality by guessing the CAPTCHA.

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
WASC	21		Insufficient Anti-Automation

引用

• REF-731 Insufficient Anti-automation

文章来源于互联网:scap中文网