CWE-304: Missing Critical Step in Authentication
Missing Critical Step in Authentication
Weakness ID: 304 (Weakness Base) Status: Draft
Description
Description Summary
The software implements an authentication technique, but it
skips a step that weakens the technique.
Extended Description
Authentication techniques should follow the algorithms that define them
exactly, otherwise authentication can be bypassed or more easily subjected
to brute force attacks.
Time of Introduction
Architecture and Design
Implementation
Observed Examples
Reference Description CVE-2004-2163 Shared secret not verified in a RADIUS response
packet, allowing authentication bypass by spoofing server
replies.
Relationships
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Missing Critical Step in Authentication
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time of Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships,
Taxonomy Mappings 2008-10-14 CWE Content Team MITRE Internal updated Description 2009-03-10 CWE Content Team MITRE Internal updated Relationships
Description
