747
Nature Type ID Name Page
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER No Authentication for Critical Function
Software Fault Patterns SFP31 Missing authentication
ISA/IEC 62443 Part 4-2 Req CR 1.1
ISA/IEC 62443 Part 4-2 Req CR 1.2
ISA/IEC 62443 Part 4-2 Req CR 2.1
ISA/IEC 62443 Part 4-1 Req SR-2
ISA/IEC 62443 Part 4-1 Req SVV-3
Related Attack Patterns
CAPEC-ID Attack Pattern Name
12 Choosing Message Identifier
36 Using Unpublished Interfaces or Functionality
62 Cross Site Request Forgery
166 Force the System to Reset Values
216 Communication Channel Manipulation
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-257]Frank Kim. "Top 25 Series - Rank 19 - Missing Authentication for Critical Function". 2010
February 3. SANS Software Security Institute. < https://www.sans.org/blog/top-25-series-rank-19-
missing-authentication-for-critical-function/ >.2023-04-07.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
[REF-1295]WizCase. "Over 80 US Municipalities' Sensitive Information, Including Resident's
Personal Data, Left Vulnerable in Massive Data Breach". 2021 July 0. < https://www.wizcase.com/
blog/us-municipality-breach-report/ >.
[REF-1296]Jonathan Greig. "1,000 GB of local government data exposed by Massachusetts
software company". 2021 July 2. < https://www.zdnet.com/article/1000-gb-of-local-governmentdata-
exposed-by-massachusetts-software-company/ >.
[REF-1297]Amazon. "AWS Foundational Security Best Practices controls". 2022. < https://
docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html
>.2023-04-07.
[REF-1298]Microsoft. "Authentication and authorization in Azure App Service and Azure
Functions". 2021 November 3. < https://learn.microsoft.com/en-us/azure/app-service/overviewauthentication-
authorization >.2022-10-11.
[REF-1302]Google Cloud. "Authentication and authorization use cases". 2022 October 1. < https://
cloud.google.com/docs/authentication/use-cases >.2022-10-11.
CWE-307: Improper Restriction of Excessive Authentication Attempts
Weakness ID : 307
CWE Version 4.14
CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts