736
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Phase: Implementation
Implement proper protection for immutable data (e.g. environment variable, hidden form fields,
etc.)
Demonstrative Examples
Example 1:
In the following example, an "authenticated" cookie is used to determine whether or not a user
should be granted access to a system.
Example Language: Java (Bad)
boolean authenticated = new Boolean(getCookieValue("authenticated")).booleanValue();
if (authenticated) {
...
}
Modifying the value of a cookie on the client-side is trivial, but many developers assume that
cookies are essentially immutable.
Observed Examples
Reference Description
CVE-2002-0367 DebPloit
https://www.cve.org/CVERecord?id=CVE-2002-0367
CVE-2004-0261 Web auth
https://www.cve.org/CVERecord?id=CVE-2004-0261
CVE-2002-1730 Authentication bypass by setting certain cookies to "true".
https://www.cve.org/CVERecord?id=CVE-2002-1730
CVE-2002-1734 Authentication bypass by setting certain cookies to "true".
https://www.cve.org/CVERecord?id=CVE-2002-1734
CVE-2002-2064 Admin access by setting a cookie.
https://www.cve.org/CVERecord?id=CVE-2002-2064
CVE-2002-2054 Gain privileges by setting cookie.
https://www.cve.org/CVERecord?id=CVE-2002-2054
CVE-2004-1611 Product trusts authentication information in cookie.
https://www.cve.org/CVERecord?id=CVE-2004-1611
CVE-2005-1708 Authentication bypass by setting admin-testing variable to true.
https://www.cve.org/CVERecord?id=CVE-2005-1708
CVE-2005-1787 Bypass auth and gain privileges by setting a variable.
https://www.cve.org/CVERecord?id=CVE-2005-1787
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-303: Incorrect Implementation of Authentication Algorithm