CWE-1470 詳細資料

The product supports user accounts that include a user's external identifier or communications channel - such as email, phone number, social media account, or domain name - but it does not properly verify that the user actually controls the associated identifier or channel.

引入方式

Architecture and Design

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

架構

類別： Not Architecture-Specific (Undetermined)

技術

類別： Not Technology-Specific (Undetermined)

常見後果

潛在緩解措施

Phases : Architecture and Design // Implementation

漏洞對應備注

理由說明 : This CWE Entry is a Class and might have lower-level children that would be more appropriate
備註 : Examine children of this entry to see if there is a better fit

參考資料

REF-1572

New Research Paper: Pre-hijacking Attacks on Web User Accounts
Microsoft.
https://www.microsoft.com/en-us/msrc/blog/2022/05/pre-hijacking-attacks

REF-1573

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web
Avinash Sudhodanan, Andrew Paverd.
https://arxiv.org/abs/2205.10174

REF-1574

NIST SP 800-63C-4: Digital Identity Guidelines: Identity Proofing and Enrollment. Section 3.8. Requirements for Confirmation Codes
NIST.
https://doi.org/10.6028/NIST.SP.800-63A-4

提交