CWE-804 可猜测的验证码
Guessable CAPTCHA
结构: Simple
Abstraction: Base
状态: Incomplete
被利用可能性: unkown
基本描述
The software uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
扩展描述
An automated attacker could bypass the intended protection of the CAPTCHA challenge and perform actions at a higher frequency than humanly possible, such as launching spam attacks.
There can be several different causes of a guessable CAPTCHA:
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 863 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 863 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000
-
cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699
-
cwe_Nature: ChildOf cwe_CWE_ID: 330 cwe_View_ID: 1000
-
cwe_Nature: ChildOf cwe_CWE_ID: 330 cwe_View_ID: 699
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
Technology: {'cwe_Name': 'Web Server', 'cwe_Prevalence': 'Sometimes'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| ['Access Control', 'Other'] | ['Bypass Protection Mechanism', 'Other'] | When authorization, authentication, or another protection mechanism relies on CAPTCHA entities to ensure that only human actors can access certain functionality, then an automated attacker such as a bot may access the restricted functionality by guessing the CAPTCHA. |
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| WASC | 21 | Insufficient Anti-Automation |
引用
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论