CWE - CWE-724: OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management (2.4)

OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management

Category ID: 724 (Category)

Status: Incomplete

Description

Description Summary

Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2004.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ParentOf	Category	255	Credentials Management	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	259	Use of Hard-coded Password	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Class	287	Improper Authentication	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	296	Improper Following of a Certificate's Chain of Trust	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Variant	298	Improper Validation of Certificate Expiration	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Variant	302	Authentication Bypass by Assumed-Immutable Data	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	304	Missing Critical Step in Authentication	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	307	Improper Restriction of Excessive Authentication Attempts	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	309	Use of Password System for Primary Authentication	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Class	345	Insufficient Verification of Data Authenticity	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Compound Element: Composite	384	Session Fixation	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	521	Weak Password Requirements	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	522	Insufficiently Protected Credentials	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Variant	525	Information Exposure Through Browser Caching	Weaknesses in OWASP Top Ten (2004)711
ParentOf	Weakness Class	592	Authentication Bypass Issues	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	613	Insufficient Session Expiration	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Variant	620	Unverified Password Change	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	640	Weak Password Recovery Mechanism for Forgotten Password	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Base	798	Use of Hard-coded Credentials	Weaknesses in OWASP Top Ten (2004) (primary)711
MemberOf	View	711	Weaknesses in OWASP Top Ten (2004)	Weaknesses in OWASP Top Ten (2004) (primary)711

Related Attack Patterns

CAPEC-ID	Attack Pattern Name	(CAPEC Version: 1.7.1)
31	Accessing/Intercepting/Modifying HTTP Cookies
57	Utilizing REST's Trust in the System Resource to Register Man in the Middle
94	Man in the Middle Attack

References

OWASP. "A3 Broken Authentication and Session Management". 2007. <http://sourceforge.net/project/showfiles.php?group_id=64424&package_id=70827>.

Content History

Submissions
Submission Date	Submitter	Organization	Source
2008-08-15		Veracode	External Submission
2008-08-15	Suggested creation of view and provided mappings
Modifications
Modification Date	Modifier	Organization	Source
2009-03-10	CWE Content Team	MITRE	Internal
2009-03-10	updated Related_Attack_Patterns, Relationships
2010-02-16	CWE Content Team	MITRE	Internal
2010-02-16	updated Relationships


	CWE is co-sponsored by the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2013, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us

Common Weakness Enumeration

CWE-724: OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management