1020
Example Language: Verilog (Good)
assign addr_auth = (address == 32'hF00 || address == 32'h800F00) ? 1: 0;
Observed Examples
Reference Description
CVE-2020-8004 When the internal flash is protected by blocking access on the Data Bus
(DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).
https://www.cve.org/CVERecord?id=CVE-2020-8004
CVE-2002-0567 DB server assumes that local clients have performed authentication, allowing
attacker to directly connect to a process to load libraries and execute
commands; a socket interface also exists (another alternate channel), so
attack can be remote.
https://www.cve.org/CVERecord?id=CVE-2002-0567
CVE-2002-1578 Product does not restrict access to underlying database, so attacker can
bypass restrictions by directly querying the database.
https://www.cve.org/CVERecord?id=CVE-2002-1578
CVE-2003-1035 User can avoid lockouts by using an API instead of the GUI to conduct brute
force password guessing.
https://www.cve.org/CVERecord?id=CVE-2003-1035
CVE-2002-1863 FTP service can not be disabled even when other access controls would
require it.
https://www.cve.org/CVERecord?id=CVE-2002-1863
CVE-2002-0066 Windows named pipe created without authentication/access control, allowing
configuration modification.
https://www.cve.org/CVERecord?id=CVE-2002-0066
CVE-2004-1461 Router management interface spawns a separate TCP connection after
authentication, allowing hijacking by attacker coming from the same IP
address.
https://www.cve.org/CVERecord?id=CVE-2004-1461
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 956 SFP Secondary Cluster: Channel Attack 888 2397
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
This can be primary to authentication errors, and resultant from unhandled error conditions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unprotected Alternate Channel
CWE-421: Race Condition During Access to Alternate Channel
Weakness ID : 421
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-421: Race Condition During Access to Alternate Channel
CWE-421: Race Condition During Access to Alternate Channel