日本語

CWE-307 詳細

CWE-307

Improper Restriction of Excessive Authentication Attempts
2006-07-19
00h00 +00:00
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

一般情報

導入モード

Architecture and Design : COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)
名前： Go (Undetermined)

一般的な結果

スコープ 影響 可能性
Access ControlBypass Protection Mechanism

注記：An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.

観察された例

参考文献 説明

CVE-2019-0039

the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing

CVE-1999-1152

Product does not disconnect or timeout after multiple failed logins.

CVE-2001-1291

Product does not disconnect or timeout after multiple failed logins.

CVE-2001-0395

Product does not disconnect or timeout after multiple failed logins.

CVE-2001-1339

Product does not disconnect or timeout after multiple failed logins.

CVE-2002-0628

Product does not disconnect or timeout after multiple failed logins.

CVE-1999-1324

User accounts not disabled when they exceed a threshold; possibly a resultant problem.

潜在的な緩和策

Phases : Architecture and Design
Phases : Architecture and Design

検出方法

Dynamic Analysis with Automated Results Interpretation

有効性 : High

Dynamic Analysis with Manual Results Interpretation

有効性 : High

Manual Static Analysis - Source Code

有効性 : High

Automated Static Analysis - Source Code

有効性 : SOAR Partial

Automated Static Analysis

有効性 : SOAR Partial

Architecture or Design Review

有効性 : High

脆弱性マッピングノート

理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

関連する攻撃パターン

CAPEC ID 攻撃パターン名
CAPEC-16 Dictionary-based Password Attack
CAPEC-49 Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-560 Use of Known Domain Credentials
CAPEC-565 Password Spraying
CAPEC-600 Credential Stuffing
CAPEC-652 Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653 Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.

参考文献

REF-45

OWASP Enterprise Security API (ESAPI) Project
OWASP.
https://owasp.org/www-project-enterprise-security-api/

REF-236

Weak Password Brings 'Happiness' to Twitter Hacker
Kim Zetter.
https://www.wired.com/2009/01/professed-twitt/

REF-1218

This Black Box Can Brute Force Crack iPhone PIN Passcodes
Graham Cluley.
https://www.intego.com/mac-security-blog/iphone-pin-pass-code/

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

REF-1482

D3FEND: D3-TL Trusted Library
D3FEND.
https://d3fend.mitre.org/technique/d3f:TrustedLibrary/

REF-1355

dmi_jtag.sv
Florian Zaruba.
https://github.com/HACK-EVENT/hackatdac21/blob/71103971e8204de6a61afc17d3653292517d32bf/piton/design/chip/tile/ariane/src/riscv-dbg/src/dmi_jtag.sv#L192:L204

REF-1566

Golang Secure Coding Practices guide
OWASP.
https://github.com/OWASP/Go-SCP

登録情報

名前 組織 日付 リリース日 Version
PLOVER 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

変更履歴

名前 組織 日付 コメント
Sean Eidemiller Cigital 2008-07-01 +00:00 added/updated demonstrative examples
CWE Content Team MITRE 2008-09-08 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2009-03-10 +00:00 updated Relationships
CWE Content Team MITRE 2009-07-27 +00:00 updated Observed_Examples
CWE Content Team MITRE 2009-12-28 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations
CWE Content Team MITRE 2010-02-16 +00:00 updated Demonstrative_Examples, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2010-04-05 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2011-03-29 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2011-06-27 +00:00 updated Common_Consequences, Related_Attack_Patterns, Relationships
CWE Content Team MITRE 2011-09-13 +00:00 updated Potential_Mitigations, References, Relationships
CWE Content Team MITRE 2012-05-11 +00:00 updated Relationships
CWE Content Team MITRE 2014-07-30 +00:00 updated Detection_Factors, Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2017-11-08 +00:00 updated Demonstrative_Examples, Modes_of_Introduction, Relationships
CWE Content Team MITRE 2019-06-20 +00:00 updated Demonstrative_Examples, Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Detection_Factors, Relationships
CWE Content Team MITRE 2020-08-20 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2021-10-28 +00:00 updated Demonstrative_Examples, References, Relationships
CWE Content Team MITRE 2022-10-13 +00:00 updated Demonstrative_Examples, Description, Observed_Examples, References, Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Demonstrative_Examples, References, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-11-19 +00:00 updated Common_Consequences, Description, Diagram
CWE Content Team MITRE 2025-09-09 +00:00 updated Demonstrative_Examples, Detection_Factors, Potential_Mitigations, References
CWE Content Team MITRE 2025-12-11 +00:00 updated Relationships, Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Applicable_Platforms, Demonstrative_Examples, References, Relationships, Taxonomy_Mappings
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。