1701
Nature Type ID Name Page
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 21 Insufficient Anti-Automation
References
[REF-731]Web Application Security Consortium. "Insufficient Anti-automation". < http://
projects.webappsec.org/Insufficient+Anti-automation >.
CWE-804: Guessable CAPTCHA
Weakness ID : 804
Structure : Simple
Abstraction : Base
Description
The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically
recognized by a non-human actor.
Extended Description
An automated attacker could bypass the intended protection of the CAPTCHA challenge and
perform actions at a higher frequency than humanly possible, such as launching spam attacks.
There can be several different causes of a guessable CAPTCHA:
• An audio or visual image that does not have sufficient distortion from the unobfuscated source
image.
• A question is generated with a format that can be automatically recognized, such as a math
question.
• A question for which the number of possible answers is limited, such as birth years or favorite
sports teams.
• A general-knowledge or trivia question for which the answer can be accessed using a data
base, such as country capitals or popular entertainers.
• Other data associated with the CAPTCHA may provide hints about its contents, such as an
image whose filename contains the word that is used in the CAPTCHA.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1390 Weak Authentication 2267
ChildOf 863 Incorrect Authorization 1787
CanFollow 330 Use of Insufficiently Random Values 814
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
CWE Version 4.14
CWE-805: Buffer Access with Incorrect Length Value
CWE-805: Buffer Access with Incorrect Length Value