CWE-305
Authentication Bypass by Primary Weakness
2006-07-19
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
一般資訊
引入方式
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Access Control | Bypass Protection Mechanism |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2002-1374 | The provided password is only compared against the first character of the real password. |
CVE-2000-0979 | The password is not properly checked, which allows remote attackers to bypass access controls by sending a 1-character password that matches the first character of the real password. |
CVE-2001-0088 | Chain: Forum software does not properly initialize an array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the password and gain administrative privileges. |
漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
備注
Most "authentication bypass" errors are resultant, not primary.提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Relationship_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Observed_Examples |
