1700
Scope Impact Likelihood
Access Control
Other
Bypass Protection Mechanism
Other
Demonstrative Examples
Example 1:
In the following code a username and password is read from a socket and an attempt is made to
authenticate the username and password. The code will continuously checked the socket for a
username and password until it has been authenticated.
Example Language: C (Bad)
char username[USERNAME_SIZE];
char password[PASSWORD_SIZE];
while (isValidUser == 0) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
isValidUser = AuthenticateUser(username, password);
}
}
}
return(SUCCESS);
This code does not place any restriction on the number of authentication attempts made. There
should be a limit on the number of authentication attempts made to prevent brute force attacks as
in the following example code.
Example Language: C (Good)
int count = 0;
while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
isValidUser = AuthenticateUser(username, password);
}
}
count++;
}
if (isValidUser) {
return(SUCCESS);
}
else {
return(FAIL);
}
Observed Examples
Reference Description
CVE-2002-1876 Mail server allows attackers to prevent other users from accessing mail by
sending large number of rapid requests.
https://www.cve.org/CVERecord?id=CVE-2002-1876
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
CWE Version 4.14
CWE-804: Guessable CAPTCHA
CWE-804: Guessable CAPTCHA