2425
Nature Type ID Name Page
HasMember 289 Authentication Bypass by Alternate Name 1008 703
HasMember 290 Authentication Bypass by Spoofing 1008 705
HasMember 291 Reliance on IP Address for Authentication 1008 708
HasMember 293 Using Referer Field for Authentication 1008 710
HasMember 294 Authentication Bypass by Capture-replay 1008 712
HasMember 301 Reflection Attack in an Authentication Protocol 1008 733
HasMember 302 Authentication Bypass by Assumed-Immutable Data 1008 735
HasMember 303 Incorrect Implementation of Authentication Algorithm 1008 737
HasMember 304 Missing Critical Step in Authentication 1008 738
HasMember 305 Authentication Bypass by Primary Weakness 1008 740
HasMember 306 Missing Authentication for Critical Function 1008 741
HasMember 307 Improper Restriction of Excessive Authentication
Attempts
1008 747
HasMember 308 Use of Single-factor Authentication 1008 752
HasMember 322 Key Exchange without Entity Authentication 1008 788
HasMember 521 Weak Password Requirements 1008 1223
HasMember 593 Authentication Bypass: OpenSSL CTX Object Modified
after SSL Objects are Created
1008 1331
HasMember 603 Use of Client-Side Authentication 1008 1354
HasMember 620 Unverified Password Change 1008 1383
HasMember 640 Weak Password Recovery Mechanism for Forgotten
Password
1008 1409
HasMember 798 Use of Hard-coded Credentials 1008 1690
HasMember 836 Use of Password Hash Instead of Password for
Authentication
1008 1761
HasMember 916 Use of Password Hash With Insufficient Computational
Effort
1008 1813
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1011: Authorize Actors
Category ID : 1011
Summary
Weaknesses in this category are related to the design and architecture of a system's authorization
components. Frequently these deal with enforcing that agents have the required permissions
before performing certain operations, such as modifying data. The weaknesses in this category
could lead to a degradation of quality of the authorization capability if they are not addressed when
designing or implementing a secure architecture.
Membership
CWE Version 4.14
CWE-1011: Authorize Actors
CWE-1011: Authorize Actors