Re: Web Application Vulnerability Categorization
Seth Art <[email protected]> Tue, 1 Apr 2014 14:27:02 -0400
| Newsgroups | gmane.comp.security.web-applications |
|---|---|
| Message-ID | <CAOzeT82bFhuoVBHUTBtDoeOu1om+HEbMKLEyszPQJYd-p_hyOw@mail.gmail.com> |
m0nk, This CWE fits pretty closely: CWE-640: Weak Password Recovery Mechanism for Forgotten Password - http://cwe.mitre.org/data/definitions/640.html -Seth On Tue, Apr 1, 2014 at 2:24 PM, Seth Art <[email protected]> wrote: > m0nk, > > This CWE fits pretty closely: CWE-640: Weak Password Recovery Mechanism for > Forgotten Password - http://cwe.mitre.org/data/definitions/640.html > > -Seth > > > On Mon, Mar 31, 2014 at 10:09 PM, m@d m0nk <[email protected]> wrote: >> >> Hello Team, >> >> Greetings!!!. >> >> I have a web app with a password recovery option. There is a secret >> question and if the user enters the correct answer to the secret >> question, the username and password is provided to the user. >> >> If the password recover page / module allows multiple tries >> (brute-force and no CAPTCHA or similar mechanism), can we categorize >> this vulnerability under "Broken Authentication and Session >> Management" or does this fall under any other Vulnerability Category / >> OWASP Top 10? >> >> Thanks in advance. >> >> ch33rs, >> >> -- >> >> __| madm0nk |__ >> th3 sib3rian m0nk >> -------------------------- >> >> >> >> This list is sponsored by Cenzic >> -------------------------------------- >> Let Us Hack You. Before Hackers Do! >> It's Finally Here - The Cenzic Website HealthCheck. FREE. >> Request Yours Now! >> http://www.cenzic.com/2009HClaunch_Securityfocus >> -------------------------------------- >> > This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------