740
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Missing Critical Step in Authentication
CWE-305: Authentication Bypass by Primary Weakness
Weakness ID : 305
Structure : Simple
Abstraction : Base
Description
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the
result of a separate weakness that is primary to the authentication error.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1390 Weak Authentication 2267
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Observed Examples
Reference Description
CVE-2002-1374 The provided password is only compared against the first character of the real
password.
https://www.cve.org/CVERecord?id=CVE-2002-1374
CVE-2000-0979 The password is not properly checked, which allows remote attackers to
bypass access controls by sending a 1-byte password that matches the first
character of the real password.
https://www.cve.org/CVERecord?id=CVE-2000-0979
CVE-2001-0088 Chain: Forum software does not properly initialize an array, which inadvertently
sets the password to a single character, allowing remote attackers to easily
guess the password and gain administrative privileges.
CWE Version 4.14
CWE-306: Missing Authentication for Critical Function
CWE-306: Missing Authentication for Critical Function