699
Nature Type ID Name Page
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Relationship
This can be resultant from SQL injection vulnerabilities and other issues.
Maintenance
The Taxonomy_Mappings to ISA/IEC 62443 were added in CWE 4.10, but they are still under
review and might change in future CWE versions. These draft mappings were performed by
members of the "Mapping CWE to 62443" subgroup of the CWE-CAPEC ICS/OT Special Interest
Group (SIG), and their work is incomplete as of CWE 4.10. The mappings are included to
facilitate discussion and review by the broader ICS/OT community, and they are likely to change
in future CWE versions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Authentication Error
OWASP Top Ten 2007 A7 CWE More Specific Broken Authentication and Session
Management
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
WASC 1 Insufficient Authentication
ISA/IEC 62443 Part 3-3 Req SR 1.1
ISA/IEC 62443 Part 3-3 Req SR 1.2
ISA/IEC 62443 Part 4-2 Req CR 1.1
ISA/IEC 62443 Part 4-2 Req CR 1.2
Related Attack Patterns
CAPEC-ID Attack Pattern Name
22 Exploiting Trust in Client
57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
94 Adversary in the Middle (AiTM)
114 Authentication Abuse
115 Authentication Bypass
151 Identity Spoofing
194 Fake the Source of Data
593 Session Hijacking
633 Token Impersonation
650 Upload a Web Shell to a Web Server
References
CWE Version 4.14
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-288: Authentication Bypass Using an Alternate Path or Channel