CWE-290: Authentication Bypass by Spoofing
Description
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Access Control
Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Related weaknesses
CAPEC attack patterns that exploit it
- CAPEC-21Exploitation of Trusted Identifiers
- CAPEC-22Exploiting Trust in Client
- CAPEC-59Session Credential Falsification through Prediction
- CAPEC-60Reusing Session IDs (aka Session Replay)
- CAPEC-94Adversary in the Middle (AiTM)
- CAPEC-459Creating a Rogue Certification Authority Certificate
- CAPEC-461Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
- CAPEC-473Signature Spoof
- CAPEC-476Signature Spoofing by Misrepresentation
- CAPEC-667Bluetooth Impersonation AttackS (BIAS)