CWE-302: Authentication Bypass by Assumed-Immutable Data
Description
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Example - 1
In the following example, an "authenticated" cookie is used to determine whether or not a user should be granted access to a system.
...boolean authenticated = new Boolean(getCookieValue("authenticated")).booleanValue();if (authenticated) {}Modifying the value of a cookie on the client-side is trivial, but many developers assume that cookies are essentially immutable.
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.