Unprotected Primary Channel

Opis

The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

Skutki

• Access Control

  Gain Privileges or Assume Identity; Bypass Protection Mechanism

Zapobieganie

• Architecture and Design

  Do not expose administrative functionnality on the user UI.

• Architecture and Design

  Protect the administrative/restricted functionality with a strong authentication mechanism.

Słabość nadrzędna

• CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

Kiedy powstaje

• Architecture and Design — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
• Implementation

Dotyczy

Not Language-Specific