Category-1014: 识别参与者

  • A+
所属分类:CWE(弱点枚举)

Category-1014: 识别参与者

ID: 1014
Status: Draft

Summary

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification maangment if they are not addressed when designing or implementing a secure architecture.

Membership

ID NAME
CWE-295 证书验证不恰当
CWE-296 证书信任链回溯不恰当
CWE-297 对宿主不匹配的证书验证不恰当
CWE-298 证书过期验证不恰当
CWE-299 证书撤销验证不恰当
CWE-345 对数据真实性的验证不充分
CWE-346 源验证错误
CWE-370 在初始检查后缺失对证书撤销的验证
CWE-441 未有动机的代理或中间人(混淆代理)
CWE-599 缺失对OpenSSL证书的验证
CWE-940 通信信道源的不正确验证
CWE-941 通信信道中错误指定的目的地

References

REF-9 A Catalog of Security Architecture Weaknesses.
REF-10 Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.

文章来源于互联网:scap中文网

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: