Weakness (CWE)
CWE-291: Reliance on IP Address for Authentication
The product uses an IP address for authentication.
How to prevent it (1 mitigation)
-
Architecture and Design
Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate. While IP address verification can be a useful part of an authentication scheme, but it should not be the single factor required for authentication.
Source: MITRE CWE-291
5 results · Clear filters · Feed
-
Medium 6.9
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts access b…
-
Medium 4.2
QTS, QuTS hero
A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors. We have already fixed the vulnerabili…
-
Medium 5.9
Symfony2 improper IP based access control
Damien Tournoud, from the Drupal security team, contacted us two days ago about a security issue in the Request::getClientIp() method when the trust proxy mode is enabled (Request::trustProxyData()). An application is vulnerable if it uses the client IP addre…
-
Medium 5.6
Uniway Router Administrative Web Interface reliance on ip address for authentication
A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be ini…
-
Medium 5.3
IBM Aspera Faspex security bypass
IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649.