CWE-306Missing Authentication for Critical Function

Description

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Common consequences

• Access Control,Other→Gain Privileges or Assume Identity,Varies by Context
  Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, acce

Potential mitigations

• Architecture and Design
  [object Object]
• Architecture and Design
  For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
• Architecture and Design
  [object Object]
• Architecture and Design
  [object Object]
• Implementation,System Configuration,Operation
  When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

Related CWEs

Recent CVEs classified under this CWE