1230
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
OWASP Top Ten 2007 A7 CWE More Specific Broken Authentication and Session
Management
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
Related Attack Patterns
CAPEC-ID Attack Pattern Name
50 Password Recovery Exploitation
102 Session Sidejacking
474 Signature Spoofing by Key Theft
509 Kerberoasting
551 Modify Existing Service
555 Remote Services with Stolen Credentials
560 Use of Known Domain Credentials
561 Windows Admin Shares with Stolen Credentials
600 Credential Stuffing
644 Use of Captured Hashes (Pass The Hash)
645 Use of Captured Tickets (Pass The Ticket)
652 Use of Known Kerberos Credentials
653 Use of Known Operating System Credentials
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
CWE-523: Unprotected Transport of Credentials
Weakness ID : 523
Structure : Simple
Abstraction : Base
Description
Login pages do not use adequate measures to protect the user name and password while they are
in transit from the client to the server.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 522 Insufficiently Protected Credentials 1225
CanAlsoBe 312 Cleartext Storage of Sensitive Information 764
Relevant to the view "Architectural Concepts" (CWE-1008)
CWE Version 4.14
CWE-523: Unprotected Transport of Credentials
CWE-523: Unprotected Transport of Credentials