Authenticate Actors

Opis

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Wpisy w tej grupie

• CWE-258 Empty Password in Configuration File
• CWE-259 Use of Hard-coded Password
• CWE-262 Not Using Password Aging
• CWE-263 Password Aging with Long Expiration
• CWE-287 Improper Authentication
• CWE-288 Authentication Bypass Using an Alternate Path or Channel
• CWE-289 Authentication Bypass by Alternate Name
• CWE-290 Authentication Bypass by Spoofing
• CWE-291 Reliance on IP Address for Authentication
• CWE-293 Using Referer Field for Authentication
• CWE-294 Authentication Bypass by Capture-replay
• CWE-301 Reflection Attack in an Authentication Protocol
• CWE-302 Authentication Bypass by Assumed-Immutable Data
• CWE-303 Incorrect Implementation of Authentication Algorithm
• CWE-304 Missing Critical Step in Authentication
• CWE-305 Authentication Bypass by Primary Weakness
• CWE-306 Missing Authentication for Critical Function
• CWE-307 Improper Restriction of Excessive Authentication Attempts
• CWE-308 Use of Single-factor Authentication
• CWE-322 Key Exchange without Entity Authentication
• CWE-521 Weak Password Requirements
• CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
• CWE-603 Use of Client-Side Authentication
• CWE-620 Unverified Password Change
• CWE-640 Weak Password Recovery Mechanism for Forgotten Password
• CWE-798 Use of Hard-coded Credentials
• CWE-836 Use of Password Hash Instead of Password for Authentication
• CWE-916 Use of Password Hash With Insufficient Computational Effort

Źródła