The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Allowed-with-Review | C | 1390 | Weak Authentication |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 947 | SFP Secondary Cluster: Authentication Bypass |
| MemberOf | Prohibited | C | 1010 | Authenticate Actors |
| MemberOf | Prohibited | C | 1211 | Authentication Errors |
| MemberOf | Prohibited | C | 1396 | Comprehensive Categorization: Access Control |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-316 | Bypass Protection Mechanism (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1010 | Authenticate Actors |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1211 | Authentication Errors |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 947 | SFP Secondary Cluster: Authentication Bypass |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Access Control | N/A | Bypass Protection Mechanism | N/A |
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
| Reference | Description |
|---|---|
| CVE-2002-1374 | The provided password is only compared against the first character of the real password. |
| CVE-2000-0979 | The password is not properly checked, which allows remote attackers to bypass access controls by sending a 1-byte password that matches the first character of the real password. |
| CVE-2001-0088 | Chain: Forum software does not properly initialize an array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the password and gain administrative privileges. |
| Ordinality | Description |
|---|
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Most "authentication bypass" errors are resultant, not primary.
N/A
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| PLOVER | N/A | N/A | Authentication Bypass by Primary Weakness |
| ID | Name |
|---|