Weakness · CWE-288
Authentication Bypass Using an Alternate Path or Channel
A second route (a debug port, an API) reaches the protected function without the login check.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- AC-2Account ManagementAccess Control · mitigates 10 techniques
- AC-6Least PrivilegeAccess Control · mitigates 10 techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 10 techniques
- AC-3Access EnforcementAccess Control · mitigates 9 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 9 techniques
- AC-5Separation of DutiesAccess Control · mitigates 8 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 8 techniques
- CM-5Access Restrictions for ChangeConfiguration Management · mitigates 7 techniques
- IA-2Identification and Authentication (Organizational Users)Identification and Authentication · mitigates 7 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 6 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.