Read Time:58 Second

Description

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-287
CWE-287
CWE-668

 

Consequences

Access Control: Gain Privileges or Assume Identity

An attacker could gain access to user accounts and access sensitive data used by the user accounts.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Use an appropriate security mechanism to protect the credentials.

Phase: Architecture and Design

Description: 

Make appropriate use of cryptography to protect the credentials.

Phase: Implementation

Description: 

Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

CVE References

  • CVE-2007-0681
    • Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions.
  • CVE-2000-0944
    • Web application password change utility doesn’t check the original password.
  • CVE-2005-3435
    • product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
  • CVE-2005-0408
    • chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.