CWE-306—Missing Authentication for Critical Function
PUBLISHEDweakness recordHigh
released 2006-07-19 · last modified 2025-12-11
Metadata
- CWE ID：
- CWE-306
- 摘要：
- Base
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2006-07-19
- 更新日期：
- 2025-12-11
名称
Missing Authentication for Critical Function
描述
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
常见后果
- 范围：
- Access Control, Other
- 影响：
- Gain Privileges or Assume Identity, Varies by Context
- 注释：
- Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
