1441
Example 2:
When authenticating, use multiple factors, such as "something you know" (such as a password)
and "something you have" (such as a hardware-based one-time password generator, or a biometric
device).
Observed Examples
Reference Description
CVE-2022-35248 Chat application skips validation when Central Authentication Service (CAS) is
enabled, effectively removing the second factor from two-factor authentication
https://www.cve.org/CVERecord?id=CVE-2022-35248
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Notes
Maintenance
This entry is closely associated with the term "Separation of Privilege." This term is used in
several different ways in the industry, but they generally combine two closely related principles:
compartmentalization (CWE-653) and using only one factor in a security decision (this entry).
Proper compartmentalization implicitly introduces multiple factors into a security decision, but
there can be cases in which multiple factors are required for authentication or other mechanisms
that do not involve compartmentalization, such as performing all required checks on a submitted
certificate. It is likely that CWE-653 and CWE-654 will provoke further discussion.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 4-1 Req SD-3
ISA/IEC 62443 Part 4-1 Req SD-4
ISA/IEC 62443 Part 4-1 Req SI-1
Related Attack Patterns
CAPEC-ID Attack Pattern Name
16 Dictionary-based Password Attack
49 Password Brute Forcing
55 Rainbow Table Password Cracking
70 Try Common or Default Usernames and Passwords
274 HTTP Verb Tampering
560 Use of Known Domain Credentials
565 Password Spraying
600 Credential Stuffing
652 Use of Known Kerberos Credentials
653 Use of Known Operating System Credentials
References
[REF-196]Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer
Systems". Proceedings of the IEEE 63. 1975 September. < http://web.mit.edu/Saltzer/www/
publications/protection/ >.
CWE Version 4.14
CWE-655: Insufficient Psychological Acceptability
CWE-655: Insufficient Psychological Acceptability