名稱: Authenticate Actors

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

CWE 成員列表

CWE-258: Empty Password in Configuration File 基礎

CWE-259: Use of Hard-coded Password 基礎

CWE-262: Not Using Password Aging 基礎

CWE-263: Password Aging with Long Expiration 基礎

CWE-287: Improper Authentication 基礎

CWE-288: Authentication Bypass Using an Alternate Path or Channel 基礎

CWE-289: Authentication Bypass by Alternate Name 基礎

CWE-290: Authentication Bypass by Spoofing 基礎

CWE-291: Reliance on IP Address for Authentication 基礎

CWE-293: Using Referer Field for Authentication 基礎

CWE-294: Authentication Bypass by Capture-replay 基礎

CWE-301: Reflection Attack in an Authentication Protocol 基礎

CWE-302: Authentication Bypass by Assumed-Immutable Data 基礎

CWE-303: Incorrect Implementation of Authentication Algorithm 基礎

CWE-304: Missing Critical Step in Authentication 基礎

CWE-305: Authentication Bypass by Primary Weakness 基礎

CWE-306: Missing Authentication for Critical Functionality 基礎

CWE-307: Improper Restriction of Excessive Authentication Attempts 基礎

CWE-308: Use of Single-factor Authentication 基礎

CWE-322: Key Exchange without Entity Authentication 基礎

CWE-521: Weak Password Requirements 基礎

CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created 基礎

CWE-603: Use of Client-Side Authentication 基礎

CWE-620: Unverified Password Change 基礎

CWE-640: Weak Password Recovery Mechanism for Forgotten Password 基礎

CWE-798: Use of Hard-coded Credentials 基礎

CWE-836: Use of Password Hash Instead of Password for Authentication 基礎

CWE-916: Use of Password Hash With Insufficient Computational Effort 基礎

CWE 資訊

漏洞對應備注

理由說明 : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
備註 : See member weaknesses of this category.

提交

名稱	機構	日期	發布日期	Version
Joanna C.S. Santos, Mehdi Mirakhorli		2017-06-22 +00:00	2017-11-08 +00:00	2.12

修改記錄

名稱	機構	日期	備註
CWE Content Team	MITRE	2023-04-27 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes

參考資料

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

CWE-1010 類別詳細資料

CWE-1010