CWE-1470 詳細

The product supports user accounts that include a user's external identifier or communications channel - such as email, phone number, social media account, or domain name - but it does not properly verify that the user actually controls the associated identifier or channel.

導入モード

Architecture and Design

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

アーキテクチャ

クラス： Not Architecture-Specific (Undetermined)

テクノロジー

クラス： Not Technology-Specific (Undetermined)

一般的な結果

潜在的な緩和策

Phases : Architecture and Design // Implementation

脆弱性マッピングノート

理由 : This CWE Entry is a Class and might have lower-level children that would be more appropriate
コメント : Examine children of this entry to see if there is a better fit

参考文献

REF-1572

New Research Paper: Pre-hijacking Attacks on Web User Accounts
Microsoft.
https://www.microsoft.com/en-us/msrc/blog/2022/05/pre-hijacking-attacks

REF-1573

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web
Avinash Sudhodanan, Andrew Paverd.
https://arxiv.org/abs/2205.10174

REF-1574

NIST SP 800-63C-4: Digital Identity Guidelines: Identity Proofing and Enrollment. Section 3.8. Requirements for Confirmation Codes
NIST.
https://doi.org/10.6028/NIST.SP.800-63A-4

登録情報