Queen of Spoofing II
An attacker could go after the way credentials are updated or recovered (account recovery doesn’t require disclosing the old password).
|
Threat |
|
|
|
Unless an email is sent using Transport Layer Security (TLS), an attacker could request a reset password and intercept the email containing a link to reset the password. |
|
CAPEC |
CAPEC-50 - Password Recovery Exploitation |
|
ASVS |
2.1.6 - Ensure both the new and current password are required to change the password 2.2.3 - Ensure notifications are sent for password changes 2.7.2 - Ensure verifiers have short TTLs (time to live) 2.7.3 - Ensure verifiers are Single Use 2.7.4 - Ensure verifiers communicated over a secure channel |
|
CWE |
CWE... |
