이름: Guessable CAPTCHA

The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

일반 정보

취약점 도입 방식

Architecture and Design
Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

기술

이름: Web Server (Sometimes)

일반적인 결과

범위	영향	가능성
Access Control Other	Bypass Protection Mechanism, Other 참고: When authorization, authentication, or another protection mechanism relies on CAPTCHA entities to ensure that only human actors can access certain functionality, then an automated attacker such as a bot may access the restricted functionality by guessing the CAPTCHA.

관찰된 예시

참고 자료	설명
CVE-2022-4036	Chain: appointment booking app uses a weak hash (CWE-328) for generating a CAPTCHA, making it guessable (CWE-804)

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

참고 자료

REF-731

Insufficient Anti-automation
Web Application Security Consortium.
http://projects.webappsec.org/Insufficient+Anti-automation

제출

이름	조직	날짜	출시일	Version
CWE Content Team	MITRE	2010-01-15 +00:00	2010-02-16 +00:00	1.8

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2010-06-21 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences, Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Likelihood_of_Exploit
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated Description, Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2026-10-28 +00:00	updated Description, Mapping_Notes, Technical_Nuance, Weakness_Ordinalities

CWE-804 상세 정보

CWE-804