715
Nature Type ID Name Page
MemberOf 1014 Identify Actors 2429
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Mobile (Prevalence = Undetermined)
Background Details
A certificate is a token that associates an identity (principal) to a cryptographic key. Certificates can
be used to check if a public key belongs to the assumed owner.
Common Consequences
Scope Impact Likelihood
Integrity
Authentication
Bypass Protection Mechanism
Gain Privileges or Assume Identity
Detection Methods
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Web Application Scanner
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Man-in-the-middle attack tool
Effectiveness = High
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review
(not inspections)
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Source code Weakness Analyzer Context-configured Source Code Weakness
Analyzer
CWE Version 4.14
CWE-295: Improper Certificate Validation
CWE-295: Improper Certificate Validation