| 名称 |
Identity Spoofing |
|
| 攻击可能性 |
典型严重性 |
| Medium |
Medium |
|
| 摘要 |
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. |
| 前置条件 |
The identity associated with the message or resource must be removable or modifiable in an undetectable way. |
| 解决方案 | Employ robust authentication processes (e.g., multi-factor authentication). |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-287 |
Improper Authentication |
|