1411
Scope Impact Likelihood
An attacker could deny service to legitimate system users
by launching a brute force attack on the password recovery
mechanism using user ids of legitimate users.
Integrity
Other
Other
The system's security functionality is turned against the
system by the attacker.
Potential Mitigations
Phase: Architecture and Design
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly
filtered and validated.
Phase: Architecture and Design
Do not use standard weak security questions and use several security questions.
Phase: Architecture and Design
Make sure that there is throttling on the number of incorrect answers to a security question.
Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Phase: Architecture and Design
Require that the user properly answers the security question prior to resetting their password and
sending the new password to the e-mail address of record.
Phase: Architecture and Design
Never allow the user to control what e-mail address the new password will be sent to in the
password recovery mechanism.
Phase: Architecture and Design
Assign a new temporary password rather than revealing the original password.
Demonstrative Examples
Example 1:
A famous example of this type of weakness being exploited is the eBay attack. eBay always
displays the user id of the highest bidder. In the final minutes of the auction, one of the bidders
could try to log in as the highest bidder three times. After three incorrect log in attempts, eBay
password throttling would kick in and lock out the highest bidder's account for some time. An
attacker could then make their own bid and their victim would not have a chance to place the
counter bid because they would be locked out. Thus an attacker could win the auction.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 930 OWASP Top Ten 2013 Category A2 - Broken
Authentication and Session Management
928 2389
MemberOf 959 SFP Secondary Cluster: Weak Cryptography 888 2398
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
CWE Version 4.14
CWE-641: Improper Restriction of Names for Files and Other Resources
CWE-641: Improper Restriction of Names for Files and Other Resources