AUTHENTICATION (AT8)
Kate can bypass authentication because it does not fail secure (i.e. it defaults to allowing unauthenticated access)
Kate can bypass authentication because it does not fail secure (i.e. it defaults to allowing unauthenticated access)
OWASP SCP
28
OWASP ASVS
4.1.5
OWASP AppSensor
CAPEC
-
SAFECODE
28
Once an authentication failure is detected, access needs to be blocked. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.
NB: the key concept for this card is permitting access, even though authentication checks were undertaken and detected a failure. See AT 4 for the similar authorization failure.
Mappings
OWASP ASVS (4.0): 4.1.5
Capec: 115
OWASP SCP: 28
OWASP Appsensor:
Safecode: 28
ASVS (4.0) Cheatsheetseries Index
ASVS V4.1 - General Access Control Design
No suitable mappings were found.
