CWE-322 - Key Exchange without Entity Authentication
CWE-322 High
- Abstraction:
- Base
- Structure:
- Simple
- Status:
- Draft
- Weakness Name
Key Exchange without Entity Authentication
- Description
The product performs a key exchange with an actor without verifying the identity of that actor.
Performing a key exchange will preserve the integrity of the information sent between two entities, but this will not guarantee that the entities are who they claim they are. This may enable an attacker to impersonate an actor by modifying traffic between the two entities. Typically, this involves a victim client that contacts a malicious server that is impersonating a trusted server. If the client skips authentication or ignores an authentication failure, the malicious server may request authentication information from the user. The malicious server can then use this authentication information to log in to the trusted server using the victim's credentials, sniff traffic between the victim and trusted server, etc.
- Common Consequences
Scope: Access Control
Impact: Bypass Protection Mechanism
Notes: No authentication takes place in this process, bypassing an assumed protection of encryption.
Scope: Confidentiality
Impact: Read Application Data
Notes: The encrypted communication between a user and a trusted host may be subject to sniffing by any actor in the communication path.
- Related Weaknesses
- Release Date:
- 2006-07-19
- Latest Modification Date:
- 2023-06-29
Free security scan for your website