Description
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Potential Impact
- Integrity: Read Application Data
How to Fix
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Detection Methods
- Automated Static Analysis: Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usa...
- Manual Static Analysis: This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and m...
- Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
...
Related Weaknesses
References
View on MITRE CWE Database →
