CWE-620: Unverified Password ChangeWeakness ID: 620 Vulnerability Mapping:
ALLOWEDThis CWE ID may be used to map to real-world vulnerabilities Abstraction: BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
Description When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. Extended Description This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user. Common Consequences This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.Scope | Impact | Likelihood |
---|
Access Control
| Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity | |
Potential Mitigations
Phase: Architecture and Design When prompting for a password change, force the user to provide the original password in addition to the new password. |
Phase: Architecture and Design Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided. |
Relationships This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. Relevant to the view "Research Concepts" (CWE-1000) Nature | Type | ID | Name |
---|
ChildOf | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1390 | Weak Authentication |
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. Relevant to the view "Software Development" (CWE-699) Nature | Type | ID | Name |
---|
MemberOf | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 255 | Credentials Management Errors |
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. Relevant to the view "Architectural Concepts" (CWE-1008) Nature | Type | ID | Name |
---|
MemberOf | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1010 | Authenticate Actors |
Modes Of Introduction The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.Phase | Note |
---|
Architecture and Design | | Implementation | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
Demonstrative Examples Example 1 This code changes a user's password. (bad code) Example Language: PHP
$user = $_GET['user']; $pass = $_GET['pass']; $checkpass = $_GET['checkpass']; if ($pass == $checkpass) { SetUserPassword($user, $pass); }
While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account. Observed Examples Reference | Description |
| Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions. |
| Web application password change utility doesn't check the original password. |
Weakness Ordinalities Ordinality | Description |
Primary | (where the weakness exists independent of other weaknesses) |
Resultant | (where the weakness is typically related to the presence of some other weaknesses) |
Memberships This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources. Vulnerability Mapping Notes Usage: ALLOWED (this CWE ID could be used to map to real-world vulnerabilities) | Reason: Acceptable-Use | Rationale: This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities. | Comments: Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. |
Taxonomy Mappings Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
OWASP Top Ten 2004 | A3 | CWE More Specific | Broken Authentication and Session Management |
Software Fault Patterns | SFP31 | | Missing authentication |
References
[REF-44] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 19: Use of Weak Password-Based Systems." Page 279. McGraw-Hill. 2010.
|
Content History Submissions |
---|
Submission Date | Submitter | Organization |
---|
2007-05-07 (CWE Draft 6, 2007-05-07) | CWE Content Team | MITRE | | Modifications |
---|
Modification Date | Modifier | Organization |
---|
2008-07-01 | Eric Dalci | Cigital | updated Time_of_Introduction | 2008-08-15 | | Veracode | Suggested OWASP Top Ten 2004 mapping | 2008-09-08 | CWE Content Team | MITRE | updated Description, Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings | 2008-11-24 | CWE Content Team | MITRE | updated Observed_Examples | 2009-05-27 | CWE Content Team | MITRE | updated Demonstrative_Examples | 2009-12-28 | CWE Content Team | MITRE | updated Other_Notes, Weakness_Ordinalities | 2011-06-01 | CWE Content Team | MITRE | updated Common_Consequences | 2012-05-11 | CWE Content Team | MITRE | updated Demonstrative_Examples, Observed_Examples, References, Relationships | 2012-10-30 | CWE Content Team | MITRE | updated Potential_Mitigations | 2014-06-23 | CWE Content Team | MITRE | updated Relationships | 2014-07-30 | CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | 2017-11-08 | CWE Content Team | MITRE | updated Applicable_Platforms, Modes_of_Introduction, Relationships | 2018-03-27 | CWE Content Team | MITRE | updated Relationships | 2020-02-24 | CWE Content Team | MITRE | updated Relationships, Type | 2021-10-28 | CWE Content Team | MITRE | updated Relationships | 2022-10-13 | CWE Content Team | MITRE | updated Relationships | 2023-04-27 | CWE Content Team | MITRE | updated Relationships | 2023-06-29 | CWE Content Team | MITRE | updated Mapping_Notes |
More information is available — Please edit the custom filter or select a different filter.
|