Authentication Errors

Opis

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

Wpisy w tej grupie

• CWE-289 Authentication Bypass by Alternate Name
• CWE-290 Authentication Bypass by Spoofing
• CWE-294 Authentication Bypass by Capture-replay
• CWE-295 Improper Certificate Validation
• CWE-301 Reflection Attack in an Authentication Protocol
• CWE-303 Incorrect Implementation of Authentication Algorithm
• CWE-305 Authentication Bypass by Primary Weakness
• CWE-306 Missing Authentication for Critical Function
• CWE-307 Improper Restriction of Excessive Authentication Attempts
• CWE-308 Use of Single-factor Authentication
• CWE-309 Use of Password System for Primary Authentication
• CWE-322 Key Exchange without Entity Authentication
• CWE-603 Use of Client-Side Authentication
• CWE-645 Overly Restrictive Account Lockout Mechanism
• CWE-804 Guessable CAPTCHA
• CWE-836 Use of Password Hash Instead of Password for Authentication