735
Nature Type ID Name Page
MemberOf 718 OWASP Top Ten 2007 Category A7 - Broken
Authentication and Session Management
629 2332
MemberOf 884 CWE Cross-section 884 2567
MemberOf 956 SFP Secondary Cluster: Channel Attack 888 2397
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
The term "reflection" is used in multiple ways within CWE and the community, so its usage
should be reviewed.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Reflection attack in an auth protocol
OWASP Top Ten 2007 A7 CWE More Specific Broken Authentication and Session
Management
Related Attack Patterns
CAPEC-ID Attack Pattern Name
90 Reflection Attack in Authentication Protocol
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-302: Authentication Bypass by Assumed-Immutable Data
Weakness ID : 302
Structure : Simple
Abstraction : Base
Description
The authentication scheme or implementation uses key data elements that are assumed to be
immutable, but can be controlled or modified by the attacker.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 807 Reliance on Untrusted Inputs in a Security Decision 1714
ChildOf 1390 Weak Authentication 2267
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Applicable Platforms
CWE Version 4.14
CWE-302: Authentication Bypass by Assumed-Immutable Data
CWE-302: Authentication Bypass by Assumed-Immutable Data