CWE-1390
Weak Authentication
2022-10-13
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Thông tin chung
Các cách xuất hiện
Architecture and DesignImplementation
Nền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Tên: Go (Undetermined)
Công nghệ
Lớp: ICS/OT (Undetermined)Lớp: Not Technology-Specific (Undetermined)
Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Integrity Confidentiality Availability Access Control | Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands Ghi chú: Attackers may be able to bypass weak authentication faster and/or with less effort than expected. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code. |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2024-48445 | Chain: e-commerce app relies on an easily-guessable timestamp (CWE-341) in a weak authentication algorithm (CWE-1390) |
CVE-2022-30034 | Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390). |
CVE-2022-35248 | Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication |
CVE-2021-3116 | Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390) |
CVE-2022-29965 | Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords |
CVE-2022-29959 | Initialization file contains credentials that can be decoded using a "simple string transformation" |
CVE-2020-8994 | UART interface for AI speaker uses empty password for root shell |
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is a Class and might have Base-level children that would be more appropriateBình luận : Examine children of this entry to see if there is a better fit
Tài liệu tham khảo
REF-1283
OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk managementForescout Vedere Labs.
https://www.forescout.com/resources/ot-icefall-report/
REF-1566
Golang Secure Coding Practices guideOWASP.
https://github.com/OWASP/Go-SCP
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 4.9 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CWE Content Team | MITRE | updated Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Common_Consequences, Description, References, Relationships, Taxonomy_Mappings |
