1702
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Server (Prevalence = Sometimes)
Common Consequences
Scope Impact Likelihood
Access Control
Other
Bypass Protection Mechanism
Other
When authorization, authentication, or another protection
mechanism relies on CAPTCHA entities to ensure that
only human actors can access certain functionality, then
an automated attacker such as a bot may access the
restricted functionality by guessing the CAPTCHA.
Observed Examples
Reference Description
CVE-2022-4036 Chain: appointment booking app uses a weak hash (CWE-328) for generating
a CAPTCHA, making it guessable (CWE-804)
https://www.cve.org/CVERecord?id=CVE-2022-4036
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 21 Insufficient Anti-Automation
References
[REF-731]Web Application Security Consortium. "Insufficient Anti-automation". < http://
projects.webappsec.org/Insufficient+Anti-automation >.
CWE-805: Buffer Access with Incorrect Length Value
Weakness ID : 805
Structure : Simple
Abstraction : Base
Description
The product uses a sequential operation to read or write a buffer, but it uses an incorrect length
value that causes it to access memory that is outside of the bounds of the buffer.
Extended Description
When the length value exceeds the size of the destination, a buffer overflow could occur.
Relationships
CWE Version 4.14
CWE-805: Buffer Access with Incorrect Length Value
CWE-805: Buffer Access with Incorrect Length Value