748
Structure : Simple
Abstraction : Base
Description
The product does not implement sufficient measures to prevent multiple failed authentication
attempts within a short time frame, making it more susceptible to brute force attacks.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 799 Improper Control of Interaction Frequency 1699
ChildOf 1390 Weak Authentication 2267
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 287 Improper Authentication 692
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
An attacker could perform an arbitrary number of
authentication attempts using different passwords, and
eventually gain access to the targeted account.
Detection Methods
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Web Application Scanner Web Services Scanner Database Scanners Cost effective for partial
coverage: Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that
audit mechanisms work, ensure host configuration meets certain predefined criteria
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective: Fuzz
Tester Framework-based Fuzzer Cost effective for partial coverage: Forced Path Execution
Effectiveness = High
Manual Static Analysis - Source Code
CWE Version 4.14
CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts