COMMON WEAKNESS ENUMERATIONIncomplete

CWE-288

Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Yaşam döngüsü evresi

Architecture and Design

This is often seen in web applications that assume that access to a particular CGI program can only be obtained through a "front" screen, when the supporting programs are directly accessible. But this problem is not just in web apps.

Risk

Başarılı sömürü neye yol açar?

Bypass Protection Mechanism

Etkilenen güvenlik alanları: Access Control

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

MITRE görseli

Zafiyet ilişkisi ve akışı

CWE-288 MITRE diagramı