CWE-1390 Detail

CWE-1390

Weak Authentication
Incomplete
2022-10-13
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Meldingen voor een CWE
Blijf op de hoogte van wijzigingen voor een specifieke CWE.
Meldingen beheren

Naam: Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Algemene informatie

Introductiemodi

Architecture and Design
Implementation

Toepasselijke platforms

Taal

Class: Not Language-Specific (Undetermined)

Technologieën

Class: ICS/OT (Undetermined)
Class: Not Technology-Specific (Undetermined)

Veelvoorkomende gevolgen

Bereik Impact Waarschijnlijkheid
Integrity
Confidentiality
Availability
Access Control		Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands

Note: This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Waargenomen voorbeelden

Referenties Beschrijving

CVE-2024-48445

Chain: e-commerce app relies on an easily-guessable timestamp (CWE-341) in a weak authentication algorithm (CWE-1390)

CVE-2022-30034

Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).

CVE-2022-35248

Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication

CVE-2021-3116

Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)

CVE-2022-29965

Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords

CVE-2022-29959

Initialization file contains credentials that can be decoded using a "simple string transformation"

CVE-2020-8994

UART interface for AI speaker uses empty password for root shell

Notities kwetsbaarheidsmapping

Rechtvaardiging : This CWE entry is a Class and might have Base-level children that would be more appropriate
Opmerking : Examine children of this entry to see if there is a better fit

Referenties

REF-1283

OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management
Forescout Vedere Labs.
https://www.forescout.com/resources/ot-icefall-report/

Indiening

Naam Organisatie Datum Releasedatum Version
CWE Content Team MITRE 2022-10-05 +00:00 2022-10-13 +00:00 4.9

Wijzigingen

Naam Organisatie Datum Opmerking
CWE Content Team MITRE 2023-01-31 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References, Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2023-10-26 +00:00 updated Observed_Examples
CWE Content Team MITRE 2024-02-29 +00:00 updated Observed_Examples
CWE Content Team MITRE 2025-12-11 +00:00 updated Observed_Examples, Relationships, Weakness_Ordinalities
De informatie die op CVE Find wordt gepresenteerd, is afkomstig van verschillende zorgvuldig geselecteerde referentiebronnen. CVE-gegevens worden geleverd door MITRE Corporation en de National Vulnerability Database (NVD). De Known Exploited Vulnerabilities (KEV)-catalogus is afkomstig van de Cybersecurity and Infrastructure Security Agency (CISA), terwijl EPSS-scores afkomstig zijn van FIRST.org. Daarnaast worden gegevens over softwarezwakheden (CWE) en veelvoorkomende aanvalspatronen (CAPEC) bijgehouden door MITRE Corporation, en informatie over hardware- en softwareconfiguraties (CPE) wordt geleverd door de NVD.