CWE-322

Key Exchange without Entity Authentication

High

Description

The product performs a key exchange with an actor without verifying the identity of that actor.

Potential Impact

Access Control: Bypass Protection Mechanism
Confidentiality: Read Application Data

How to Fix

Architecture and Design

Ensure that proper authentication is included in the system design.

Implementation

Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

Detection Methods

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-322 vulnerabilities in your codebase.

Get Security Assessment