754
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 947 SFP Secondary Cluster: Authentication Bypass 888 2394
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Using single-factor authentication
Related Attack Patterns
CAPEC-ID Attack Pattern Name
16 Dictionary-based Password Attack
49 Password Brute Forcing
55 Rainbow Table Password Cracking
70 Try Common or Default Usernames and Passwords
509 Kerberoasting
555 Remote Services with Stolen Credentials
560 Use of Known Domain Credentials
561 Windows Admin Shares with Stolen Credentials
565 Password Spraying
600 Credential Stuffing
644 Use of Captured Hashes (Pass The Hash)
645 Use of Captured Tickets (Pass The Ticket)
652 Use of Known Kerberos Credentials
653 Use of Known Operating System Credentials
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-309: Use of Password System for Primary Authentication
Weakness ID : 309
Structure : Simple
Abstraction : Base
Description
The use of password systems as the primary means of authentication may be subject to several
flaws or shortcomings, each reducing the effectiveness of the mechanism.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-309: Use of Password System for Primary Authentication
CWE-309: Use of Password System for Primary Authentication