CWE-307: Improper Restriction of Excessive Authentication Attempts

Description

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Abstraction: BaseA weakness specific enough to point to detection and prevention methods.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

Access Control
Bypass Protection Mechanism
An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.

Potential mitigations

Architecture and Design
Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
Architecture and DesignLibraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.

Related weaknesses

Parent weaknesses

CAPEC attack patterns that exploit it

Potential mitigations

Architecture and Design

Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.

Architecture and DesignLibraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.