739
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 573 Improper Following of Specification by Caller 1298
ChildOf 303 Incorrect Implementation of Authentication Algorithm 737
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control
Integrity
Confidentiality
Bypass Protection Mechanism
Gain Privileges or Assume Identity
Read Application Data
Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources
or functionality to unintended actors, possibly providing
attackers with sensitive information or allowing attackers to
execute arbitrary code.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Observed Examples
Reference Description
CVE-2004-2163 Shared secret not verified in a RADIUS response packet, allowing
authentication bypass by spoofing server replies.
https://www.cve.org/CVERecord?id=CVE-2004-2163
CVE-2005-3327 Chain: Authentication bypass by skipping the first startup step as required by
the protocol.
https://www.cve.org/CVERecord?id=CVE-2005-3327
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 884 CWE Cross-section 884 2567
MemberOf 947 SFP Secondary Cluster: Authentication Bypass 888 2394
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
CWE Version 4.14
CWE-305: Authentication Bypass by Primary Weakness
CWE-305: Authentication Bypass by Primary Weakness