1354
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 753 2009 Top 25 - Porous Defenses 750 2353
MemberOf 884 CWE Cross-section 884 2567
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1413 Comprehensive Categorization: Protection Mechanism
Failure
1400 2542
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
Related Attack Patterns
CAPEC-ID Attack Pattern Name
21 Exploitation of Trusted Identifiers
31 Accessing/Intercepting/Modifying HTTP Cookies
162 Manipulating Hidden Fields
202 Create Malicious Client
207 Removing Important Client Functionality
208 Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements
383 Harvesting Information via API Event Monitoring
384 Application API Message Manipulation via Man-in-the-Middle
385 Transaction or Event Tampering via Application API Manipulation
386 Application API Navigation Remapping
387 Navigation Remapping To Propagate Malicious Content
388 Application API Button Hijacking
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
CWE-603: Use of Client-Side Authentication
Weakness ID : 603
Structure : Simple
Abstraction : Base
Description
A client/server product performs authentication within client code but not in server code, allowing
server-side authentication to be bypassed via a modified client that omits the authentication check.
Extended Description
Client-side authentication is extremely weak and may be breached easily. Any attacker may
read the source code and reverse-engineer the authentication mechanism to access parts of the
application which would otherwise be protected.
Relationships
CWE Version 4.14
CWE-603: Use of Client-Side Authentication
CWE-603: Use of Client-Side Authentication