2432
Category ID : 1017
Summary
Weaknesses in this category are related to the design and architecture of a system's lockout
mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts
to access a given resource. The weaknesses in this category could lead to a degradation of access
to system assets if they are not addressed when designing or implementing a secure architecture.
Membership
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 645 Overly Restrictive Account Lockout Mechanism 1008 1423
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1018: Manage User Sessions
Category ID : 1018
Summary
Weaknesses in this category are related to the design and architecture of session management.
Frequently these deal with the information or status about each user and their access rights for the
duration of multiple requests. The weaknesses in this category could lead to a degradation of the
quality of session management if they are not addressed when designing or implementing a secure
architecture.
Membership
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 6 J2EE Misconfiguration: Insufficient Session-ID Length 1008 2
HasMember 384 Session Fixation 1008 936
HasMember 488 Exposure of Data Element to Wrong Session 1008 1169
HasMember 579 J2EE Bad Practices: Non-serializable Object Stored in
Session
1008 1309
HasMember 613 Insufficient Session Expiration 1008 1371
HasMember 841 Improper Enforcement of Behavioral Workflow 1008 1772
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
CWE Version 4.14
CWE-1019: Validate Inputs
CWE-1019: Validate Inputs