700
[REF-236]Kim Zetter. "Weak Password Brings 'Happiness' to Twitter Hacker". 2009 January 9. <
https://www.wired.com/2009/01/professed-twitt/ >.2023-04-07.
[REF-237]OWASP. "Top 10 2007-Broken Authentication and Session Management". 2007. < http://
www.owasp.org/index.php/Top_10_2007-A7 >.
[REF-238]OWASP. "Guide to Authentication". < http://www.owasp.org/index.php/
Guide_to_Authentication >.
[REF-239]Microsoft. "Authentication". < http://msdn.microsoft.com/en-us/library/
aa374735(VS.85).aspx >.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
CWE-288: Authentication Bypass Using an Alternate Path or Channel
Weakness ID : 288
Structure : Simple
Abstraction : Base
Description
A product requires authentication, but the product has an alternate path or channel that does not
require authentication.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 306 Missing Authentication for Critical Function 741
ParentOf 425 Direct Request ('Forced Browsing') 1025
ParentOf 1299 Missing Protection Mechanism for Alternate Hardware
Interface