CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.6)  

CWE-307: Failure to Restrict Excessive Authentication Attempts

 
Failure to Restrict Excessive Authentication Attempts
Weakness ID: 307 (Weakness Base)Status: Draft
+ Description

Description Summary

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
+ Time of Introduction
  • Architecture and Design
+ Applicable Platforms

Languages

All

+ Demonstrative Examples

Example 1

The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked and makes no attempt to restrict excessive authentication attempts.

(Bad Code)
Java
String username = request.getParameter("username");
String password = request.getParameter("password");
int authResult = authenticateUser(username, password);
+ Observed Examples
ReferenceDescription
CVE-1999-1152Product does not disconnect or timeout after multiple failed logins.
CVE-2001-1291Product does not disconnect or timeout after multiple failed logins.
CVE-2001-0395Product does not disconnect or timeout after multiple failed logins.
CVE-2001-1339Product does not disconnect or timeout after multiple failed logins.
CVE-2002-0628Product does not disconnect or timeout after multiple failed logins.
CVE-1999-1324User accounts not disabled when they exceed a threshold; possibly a resultant problem.
+ Potential Mitigations
PhaseDescription

Common protection mechanisms include disconnecting a user, implementing a timeout, locking out a targeted account, or requiring a computational task on the user's part.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class287Improper Authentication
Development Concepts (primary)699
Research Concepts1000
ChildOfWeakness ClassWeakness Class703Failure to Handle Exceptional Conditions
Research Concepts (primary)1000
ChildOfCategoryCategory724OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2004) (primary)711
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERMultiple Failed Authentication Attempts not Prevented
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Sean EidemillerCigitalExternal
added/updated demonstrative examples
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Taxonomy Mappings
2009-03-10CWE Content TeamMITREInternal
updated Relationships
2009-07-27CWE Content TeamMITREInternal
updated Observed Examples
Back to top
Page Last Updated: October 29, 2009
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us