News for hackers. Stuff that matters.

A comment on Dozens of high-traffic websites vulnerable to ‘account pre-hijacking’, study. Parent comment

Re:Dozens of high-traffic websites vulnerable to ‘account pr... by alipitch on Wednesday June 01, 2022 @03:35AM (#31579138)
- Unexpired Email Change (UE)
[ Parent | on HN ]
Re:Dozens of high-traffic websites vulnerable to ‘account pr... by alipitch on Wednesday June 01, 2022 @03:40AM (#31579175)
possibly CWE-306?

CWE-306: Missing Authentication for Critical Function <https://cwe.mitre.org/data/definitions/306.html>

Looking at the CWE-306 wording, this does not look like the right CWE, but OWASP ASVP 3.7.1 points to this CWE.

OWASP ASVP 3.7.1 <https://github.com/OWASP/ASVS/blob/v4.0.3_release/4.0/en/0x1...>

  3.7.1
  Verify the application ensures a full, valid login session or requires re-authentication or secondary verification before allowing any sensitive transactions or account modifications.
  CWE-306
[ Parent | on HN ]