Description
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
CWE-287
CWE-287
CWE-668
Consequences
Access Control: Gain Privileges or Assume Identity
An attacker could gain access to user accounts and access sensitive data used by the user accounts.
Potential Mitigations
Phase: Architecture and Design
Description:
Use an appropriate security mechanism to protect the credentials.
Phase: Architecture and Design
Description:
Make appropriate use of cryptography to protect the credentials.
Phase: Implementation
Description:
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
CVE References
- CVE-2007-0681
- Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions.
- CVE-2000-0944
- Web application password change utility doesn’t check the original password.
- CVE-2005-3435
- product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
- CVE-2005-0408
- chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.
