1762
Nature Type ID Name Page
ChildOf 1390 Weak Authentication 2267
PeerOf 602 Client-Side Enforcement of Server-Side Security 1350
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
An attacker could bypass the authentication routine without
knowing the original password.
Observed Examples
Reference Description
CVE-2009-1283 Product performs authentication with user-supplied password hashes that can
be obtained from a separate SQL injection vulnerability (CVE-2009-1282).
https://www.cve.org/CVERecord?id=CVE-2009-1283
CVE-2005-3435 Product allows attackers to bypass authentication by obtaining the password
hash for another user and specifying the hash in the pwd argument.
https://www.cve.org/CVERecord?id=CVE-2005-3435
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
644 Use of Captured Hashes (Pass The Hash)
652 Use of Known Kerberos Credentials
CWE-837: Improper Enforcement of a Single, Unique Action
Weakness ID : 837
Structure : Simple
Abstraction : Base
Description
The product requires that an actor should only be able to perform an action once, or to have only
one unique action, but the product does not enforce or improperly enforces this restriction.
Extended Description
CWE Version 4.14
CWE-837: Improper Enforcement of a Single, Unique Action
CWE-837: Improper Enforcement of a Single, Unique Action