CWE-307 过多认证尝试的限制不恰当 类漏洞列表 332

In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…

The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.

String username = request.getParameter("username"); String password = request.getParameter("password"); int authResult = authenticateUser(username, password);