OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures

Opis

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top Ten 2021.

Wpisy w tej grupie

• CWE-255 Credentials Management Errors
• CWE-259 Use of Hard-coded Password
• CWE-287 Improper Authentication
• CWE-288 Authentication Bypass Using an Alternate Path or Channel
• CWE-290 Authentication Bypass by Spoofing
• CWE-294 Authentication Bypass by Capture-replay
• CWE-295 Improper Certificate Validation
• CWE-297 Improper Validation of Certificate with Host Mismatch
• CWE-300 Channel Accessible by Non-Endpoint
• CWE-302 Authentication Bypass by Assumed-Immutable Data
• CWE-304 Missing Critical Step in Authentication
• CWE-306 Missing Authentication for Critical Function
• CWE-307 Improper Restriction of Excessive Authentication Attempts
• CWE-346 Origin Validation Error
• CWE-384 Session Fixation
• CWE-521 Weak Password Requirements
• CWE-613 Insufficient Session Expiration
• CWE-620 Unverified Password Change
• CWE-640 Weak Password Recovery Mechanism for Forgotten Password
• CWE-798 Use of Hard-coded Credentials
• CWE-940 Improper Verification of Source of a Communication Channel
• CWE-1216 Lockout Mechanism Errors

Uwagi

As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła