CWE-304—Missing Critical Step in Authentication

名称

Missing Critical Step in Authentication

描述

The product implements an authentication technique, but it skips a step that weakens the technique.

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

常见后果

范围：

Access Control, Integrity, Confidentiality

影响：

Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data, Execute Unauthorized Code or Commands

注释：

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or allowing attackers to execute arbitrary code.

相关 CWE

• CWE-303Incorrect Implementation of Authentication Algorithm
• CWE-573Improper Following of Specification by Caller