863
PeerOf 602 Client-Side Enforcement of Server-Side Security 1350
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 287 Improper Authentication 692
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources
which are not otherwise accessible without proper
authentication.
Demonstrative Examples
Example 1:
The following code authenticates users.
Example Language: Java (Bad)
String sourceIP = request.getRemoteAddr();
if (sourceIP != null && sourceIP.equals(APPROVED_IP)) {
authenticated = true;
}
CWE Version 4.14
CWE-290: Authentication Bypass by Spoofing
CWE-290: Authentication Bypass by Spoofing