CWE-304 认证中关键步骤缺失

Missing Critical Step in Authentication

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software implements an authentication technique, but it skips a step that weakens the technique.

扩展描述

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 1000

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
['Access Control', 'Integrity', 'Confidentiality']	['Bypass Protection Mechanism', 'Gain Privileges or Assume Identity', 'Read Application Data', 'Execute Unauthorized Code or Commands']	This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or allowing attackers to execute arbitrary code.

分析过的案例

标识	说明	链接

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Missing Critical Step in Authentication

文章来源于互联网:scap中文网