1225
Reference Description
https://www.cve.org/CVERecord?id=CVE-2020-4574
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 884 CWE Cross-section 884 2567
MemberOf 951 SFP Secondary Cluster: Insecure Authentication Policy 888 2396
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
Related Attack Patterns
CAPEC-ID Attack Pattern Name
16 Dictionary-based Password Attack
49 Password Brute Forcing
55 Rainbow Table Password Cracking
70 Try Common or Default Usernames and Passwords
112 Brute Force
509 Kerberoasting
555 Remote Services with Stolen Credentials
561 Windows Admin Shares with Stolen Credentials
565 Password Spraying
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1053]NIST. "Digital Identity Guidelines (SP 800-63B)". 2017 June. < https://nvlpubs.nist.gov/
nistpubs/SpecialPublications/NIST.SP.800-63b.pdf >.2023-04-07.
CWE-522: Insufficiently Protected Credentials
Weakness ID : 522
Structure : Simple
Abstraction : Class
Description
The product transmits or stores authentication credentials, but it uses an insecure method that is
susceptible to unauthorized interception and/or retrieval.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-522: Insufficiently Protected Credentials
CWE-522: Insufficiently Protected Credentials