Nama: Overly Restrictive Account Lockout Mechanism

The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.

Informasi Umum

Detail Latar Belakang

Mode Pengenalan

Architecture and Design : COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Availability	DoS: Resource Consumption (Other) Catatan: An attacker could lock users out of their accounts by causing the account lockout mechanism to trigger, e.g. by attempting many logins. This could deny service to legitimate system users.

Mitigasi yang Memungkinkan

Phases : Architecture and Design
Implement more intelligent password throttling mechanisms such as those that take IP address into account, in addition to the login name.
Phases : Architecture and Design
Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.
Phases : Architecture and Design
Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (making it do some computation).

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pola Serangan Terkait

CAPEC ID	Nama Pola Serangan
CAPEC-2	Inducing Account Lockout An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
Evgeny Lebanidze	Cigital	2008-01-30 +00:00	2008-01-30 +00:00	Draft 8

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Enabling_Factors_for_Exploitation, Relationships
CWE Content Team	MITRE	2008-10-14 +00:00	updated Description
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Demonstrative_Examples, Description, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Observed_Examples, Relationships
CWE Content Team	MITRE	2019-06-20 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Background_Details, Common_Consequences, Description, Potential_Mitigations

Detail CWE-645

CWE-645