Chi tiết CWE-1470

The product supports user accounts that include a user's external identifier or communications channel - such as email, phone number, social media account, or domain name - but it does not properly verify that the user actually controls the associated identifier or channel.

Các cách xuất hiện

Architecture and Design

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Kiến trúc

Lớp: Not Architecture-Specific (Undetermined)

Công nghệ

Lớp: Not Technology-Specific (Undetermined)

Hậu quả phổ biến

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design // Implementation

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE Entry is a Class and might have lower-level children that would be more appropriate
Bình luận : Examine children of this entry to see if there is a better fit

Tài liệu tham khảo

REF-1572

New Research Paper: Pre-hijacking Attacks on Web User Accounts
Microsoft.
https://www.microsoft.com/en-us/msrc/blog/2022/05/pre-hijacking-attacks

REF-1573

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web
Avinash Sudhodanan, Andrew Paverd.
https://arxiv.org/abs/2205.10174

REF-1574

NIST SP 800-63C-4: Digital Identity Guidelines: Identity Proofing and Enrollment. Section 3.8. Requirements for Confirmation Codes
NIST.
https://doi.org/10.6028/NIST.SP.800-63A-4

Gửi