Detail CWE-1470

CWE-1470

Improper External Identity Verification
2026-10-28
00h00 +00:00
Incomplete
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Improper External Identity Verification

The product supports user accounts that include a user's external identifier or communications channel - such as email, phone number, social media account, or domain name - but it does not properly verify that the user actually controls the associated identifier or channel.

Informasi Umum

Mode Pengenalan

Architecture and Design

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Arsitektur

Kelas: Not Architecture-Specific (Undetermined)

Teknologi

Kelas: Not Technology-Specific (Undetermined)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
Access Control
Authentication		Gain Privileges or Assume Identity, Bypass Protection Mechanism

Mitigasi yang Memungkinkan

Phases : Architecture and Design // Implementation

Catatan Pemetaan Kerentanan

Justifikasi : This CWE Entry is a Class and might have lower-level children that would be more appropriate
Komentar : Examine children of this entry to see if there is a better fit

Referensi

REF-1572

New Research Paper: Pre-hijacking Attacks on Web User Accounts
Microsoft.
https://www.microsoft.com/en-us/msrc/blog/2022/05/pre-hijacking-attacks

REF-1573

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web
Avinash Sudhodanan, Andrew Paverd.
https://arxiv.org/abs/2205.10174

REF-1574

NIST SP 800-63C-4: Digital Identity Guidelines: Identity Proofing and Enrollment. Section 3.8. Requirements for Confirmation Codes
NIST.
https://doi.org/10.6028/NIST.SP.800-63A-4

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2026-10-26 +00:00 2026-10-28 +00:00 5.0
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.