CWE-306Missing Authentication for Critical Function

Description

Common consequences· 1

• Access Control / Other — Gain Privileges or Assume Identity, Varies by Context
  Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.

Potential mitigations· 5

• [Architecture and Design]
• [Architecture and Design]For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
• [Architecture and Design]
• [Architecture and Design]
• [Implementation, System Configuration, Operation]When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

Related CAPEC attack patterns· 5

Exploits (incoming)4

Compliance frameworks addressing this (incoming)34

Showing top 30 of 34 by confidence. Click any target to see the full neighbourhood.

(incoming)112

Showing top 30 of 112 by confidence. Click any target to see the full neighbourhood.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.