CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.4)  

CWE-287: Improper Authentication

Individual Definition in a New Window
Improper Authentication
Status: Draft
Weakness ID: 287 (Weakness Class)
+ Description
Summary

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

+ Alternate Terms
authentification

An alternate term is "authentification", which appears to be most commonly used by people from non-English-speaking countries.

+ Time of Introduction
* Architecture and Design
* Implementation
+ Applicable Platforms
Languages
All
+ Common Consequences

Authentication bypass

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class693Protection Mechanism Failure
Research Concepts (primary)1000
ChildOfCategoryCategory254Security Features
Development Concepts (primary)699
ChildOfCategoryCategory718OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2007) (primary)629
ChildOfCategoryCategory724OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2004) (primary)711
MemberOfViewView635Weaknesses Used by NVD
Weaknesses Used by NVD (primary)635
ParentOfWeakness ClassWeakness ClassWeakness Class300Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness VariantWeakness Variant301Reflection Attack in an Authentication Protocol
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base303Incorrect Implementation of Authentication Algorithm
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base304Missing Critical Step in Authentication
Development Concepts (primary)699
CanFollowWeakness BaseWeakness BaseWeakness Base304Missing Critical Step in Authentication
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness VariantWeakness Variant306No Authentication for Critical Function
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base307Failure to Restrict Excessive Authentication Attempts
Development Concepts (primary)699
Research Concepts1000
ParentOfWeakness BaseWeakness BaseWeakness Base308Use of Single-factor Authentication
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base309Use of Password System for Primary Authentication
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base322Key Exchange without Entity Authentication
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Development Concepts (primary)699
Research Concepts1000
ParentOfWeakness ClassWeakness ClassWeakness Class592Authentication Bypass Issues
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base603Use of Client-Side Authentication
Development Concepts (primary)699
Research Concepts1000
CanFollowWeakness BaseWeakness BaseWeakness Base613Insufficient Session Expiration
Development Concepts (primary)699
Research Concepts1000
ParentOfWeakness BaseWeakness BaseWeakness Base645Overly Restrictive Account Lockout Mechanism
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfCompound Element: CompositeCompound Element: Composite384Session Fixation
Development Concepts699
Research Concepts (primary)1000
+ Relationship Notes

This can be resultant from SQL injection vulnerabilities and other issues.

+ Functional Areas
* Authentication
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVER  Authentication Error
OWASP Top Ten 2007A7CWE More SpecificBroken Authentication and Session Management
OWASP Top Ten 2004A3CWE More SpecificBroken Authentication and Session Management
+ Content History
Submissions
PLOVER. (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Time_of_Introduction
Veracode. 2008-08-15. (External)
Suggested OWASP Top Ten 2004 mapping
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Alternate_Terms, Common_Consequences, Relationships, Relationship_Notes, Taxonomy_Mappings
CWE Content Team. MITRE. 2008-10-14. (Internal)
updated Relationships
CWE Content Team. MITRE. 2009-01-12. (Internal)
updated Name
CWE Content Team. MITRE. 2009-05-27. (Internal)
updated Description, Related_Attack_Patterns
Previous Entry Names
* Authentication Issues (changed 2008-04-11)
* Insufficient Authentication (changed 2009-01-12)
Back to top
Page Last Updated: May 26, 2009
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us