Incorrect Implementation of Authentication Algorithm

Opis

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

This incorrect implementation may allow authentication to be bypassed.

Skutki

• Access Control

  Bypass Protection Mechanism

Przykłady podatności

• CVE-2003-0750 Conditional should have been an 'or' not an 'and'.

Słabość nadrzędna

• CWE-1390 Weak Authentication

Słabości podrzędne

• CWE-304 Missing Critical Step in Authentication

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific