737
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 949 SFP Secondary Cluster: Faulty Endpoint Authentication 888 2395
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Authentication Bypass via Assumed-
Immutable Data
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC02-J Do not base security checks on
untrusted sources
Related Attack Patterns
CAPEC-ID Attack Pattern Name
10 Buffer Overflow via Environment Variables
13 Subverting Environment Variable Values
21 Exploitation of Trusted Identifiers
31 Accessing/Intercepting/Modifying HTTP Cookies
39 Manipulating Opaque Client-based Data Tokens
45 Buffer Overflow via Symbolic Links
77 Manipulating User-Controlled Variables
274 HTTP Verb Tampering
CWE-303: Incorrect Implementation of Authentication Algorithm
Weakness ID : 303
Structure : Simple
Abstraction : Base
Description
The requirements for the product dictate the use of an established authentication algorithm, but the
implementation of the algorithm is incorrect.
Extended Description
This incorrect implementation may allow authentication to be bypassed.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1390 Weak Authentication 2267
ParentOf 304 Missing Critical Step in Authentication 738
Relevant to the view "Architectural Concepts" (CWE-1008)
CWE Version 4.14
CWE-304: Missing Critical Step in Authentication
CWE-304: Missing Critical Step in Authentication