752
CAPEC-ID Attack Pattern Name
16 Dictionary-based Password Attack
49 Password Brute Forcing
560 Use of Known Domain Credentials
565 Password Spraying
600 Credential Stuffing
652 Use of Known Kerberos Credentials
653 Use of Known Operating System Credentials
References
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-236]Kim Zetter. "Weak Password Brings 'Happiness' to Twitter Hacker". 2009 January 9. <
https://www.wired.com/2009/01/professed-twitt/ >.2023-04-07.
[REF-1218]Graham Cluley. "This Black Box Can Brute Force Crack iPhone PIN Passcodes". The
Mac Security Blog. 2015 March 6. < https://www.intego.com/mac-security-blog/iphone-pin-passcode/
>.
CWE-308: Use of Single-factor Authentication
Weakness ID : 308
Structure : Simple
Abstraction : Base
Description
The use of single-factor authentication can lead to unnecessary risk of compromise when
compared with the benefits of a dual-factor authentication scheme.
Extended Description
While the use of multiple authentication schemes is simply piling on more complexity on top of
authentication, it is inestimably valuable to have such measures of redundancy. The use of weak,
reused, and common passwords is rampant on the internet. Without the added protection of
multiple authentication schemes, a single mistake can result in the compromise of an account. For
this reason, if multiple schemes are possible and also easy to use, they should be implemented
and required.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 654 Reliance on a Single Factor in a Security Decision 1439
ChildOf 1390 Weak Authentication 2267
PeerOf 309 Use of Password System for Primary Authentication 754
PeerOf 309 Use of Password System for Primary Authentication 754
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-308: Use of Single-factor Authentication
CWE-308: Use of Single-factor Authentication