Description
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
Potential Impact
Access Control
Bypass Protection Mechanism
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2002-0862 | Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates. |
| CVE-2002-0970 | Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates. |
| CVE-2002-1407 | Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates. |
| CVE-2005-0198 | Logic error prevents some required conditions from being enforced during Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5). |
| CVE-2004-2163 | Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies. |
| CVE-2005-2181 | Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages. |
| CVE-2005-2182 | Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages. |
| CVE-2005-2298 | Security check not applied to all components, allowing bypass. |
Related Weaknesses
Taxonomy Mappings
- PLOVER: — Improperly Implemented Security Check for Standard
Frequently Asked Questions
What is CWE-358?
CWE-358 (Improperly Implemented Security Check for Standard) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
How can CWE-358 be exploited?
Attackers can exploit CWE-358 (Improperly Implemented Security Check for Standard) to bypass protection mechanism. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-358?
Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.
What is the severity of CWE-358?
CWE-358 is classified as a Base-level weakness (Medium abstraction). It has been observed in 8 real-world CVEs.