CWE-1470 详情

The product supports user accounts that include a user's external identifier or communications channel - such as email, phone number, social media account, or domain name - but it does not properly verify that the user actually controls the associated identifier or channel.

引入方式

Architecture and Design

适用平台

编程语言

类： Not Language-Specific (Undetermined)

架构

类： Not Architecture-Specific (Undetermined)

技术

类： Not Technology-Specific (Undetermined)

常见后果

潜在缓解措施

Phases : Architecture and Design // Implementation

漏洞映射说明

依据 : This CWE Entry is a Class and might have lower-level children that would be more appropriate
备注 : Examine children of this entry to see if there is a better fit

参考资料

REF-1572

New Research Paper: Pre-hijacking Attacks on Web User Accounts
Microsoft.
https://www.microsoft.com/en-us/msrc/blog/2022/05/pre-hijacking-attacks

REF-1573

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web
Avinash Sudhodanan, Andrew Paverd.
https://arxiv.org/abs/2205.10174

REF-1574

NIST SP 800-63C-4: Digital Identity Guidelines: Identity Proofing and Enrollment. Section 3.8. Requirements for Confirmation Codes
NIST.
https://doi.org/10.6028/NIST.SP.800-63A-4

提交记录