751
else {
return(FAIL);
}
}
Example 5:
Consider this example from a real-world attack against the iPhone [REF-1218]. An attacker can
use brute force methods; each time there is a failed guess, the attacker quickly cuts the power
before the failed entry is recorded, effectively bypassing the intended limit on the number of failed
authentication attempts. Note that this attack requires removal of the cell phone battery and
connecting directly to the phone's power source, and the brute force attack is still time-consuming.
Observed Examples
Reference Description
CVE-2019-0039 the REST API for a network OS has a high limit for number of connections,
allowing brute force password guessing
https://www.cve.org/CVERecord?id=CVE-2019-0039
CVE-1999-1152 Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-1999-1152
CVE-2001-1291 Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2001-1291
CVE-2001-0395 Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2001-0395
CVE-2001-1339 Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2001-1339
CVE-2002-0628 Product does not disconnect or timeout after multiple failed logins.
https://www.cve.org/CVERecord?id=CVE-2002-0628
CVE-1999-1324 User accounts not disabled when they exceed a threshold; possibly a resultant
problem.
https://www.cve.org/CVERecord?id=CVE-1999-1324
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 812 OWASP Top Ten 2010 Category A3 - Broken
Authentication and Session Management
809 2357
MemberOf 866 2011 Top 25 - Porous Defenses 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 955 SFP Secondary Cluster: Unrestricted Authentication 888 2397
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER AUTHENT .MULTFAIL Multiple Failed Authentication Attempts
not Prevented
Software Fault Patterns SFP34 Unrestricted authentication
Related Attack Patterns
CWE Version 4.14
CWE-308: Use of Single-factor Authentication
CWE-308: Use of Single-factor Authentication