698
Reference Description
CVE-2009-2213 product uses default "Allow" action, instead of default deny, leading to
authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2009-2213
CVE-2009-2168 chain: redirect without exit (CWE-698) leads to resultant authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2009-2168
CVE-2009-3107 product does not restrict access to a listening port for a critical service,
allowing authentication to be bypassed.
https://www.cve.org/CVERecord?id=CVE-2009-3107
CVE-2009-1596 product does not properly implement a security-related configuration setting,
allowing authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2009-1596
CVE-2009-2422 authentication routine returns "nil" instead of "false" in some situations,
allowing authentication bypass using an invalid username.
https://www.cve.org/CVERecord?id=CVE-2009-2422
CVE-2009-3232 authentication update script does not properly handle when admin does not
select any authentication modules, allowing authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2009-3232
CVE-2009-3231 use of LDAP authentication with anonymous binds causes empty password to
result in successful authentication
https://www.cve.org/CVERecord?id=CVE-2009-3231
CVE-2005-3435 product authentication succeeds if user-provided MD5 hash matches the hash
in its database; this can be subjected to replay attacks.
https://www.cve.org/CVERecord?id=CVE-2005-3435
CVE-2005-0408 chain: product generates predictable MD5 hashes using a constant value
combined with username, allowing authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2005-0408
Functional Areas
• Authentication
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 718 OWASP Top Ten 2007 Category A7 - Broken
Authentication and Session Management
629 2332
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 812 OWASP Top Ten 2010 Category A3 - Broken
Authentication and Session Management
809 2357
MemberOf 930 OWASP Top Ten 2013 Category A2 - Broken
Authentication and Session Management
928 2389
MemberOf 947 SFP Secondary Cluster: Authentication Bypass 888 2394
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
CWE Version 4.14
CWE-287: Improper Authentication
CWE-287: Improper Authentication