cve.bz

CWE-294: Authentication Bypass by Capture-replay, page 4

Filter

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

What the weakness is: CWE-294 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 10
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-701 Browser in the Middle (BiTM) Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-294, as MITRE names them. Credits.

Ask an AI about CWE-294

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-294: Authentication Bypass by Capture-replay and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/294.html and https://cve.bz/cve/cwe/294?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2018-9477EPSS 0.09%

    In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…

  2. 4.8CVE-2024-36250EPSS 0.2%

    Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds

  3. 7.7CVE-2024-40715EPSS 0.6%

    A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.

  4. 6.5CVE-2024-22066EPSS 0.3%

    There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the vulnerability to obtain sensitive information about the device.

  5. 8.8CVE-2024-46041EPSS 0.3%

    IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.

  6. 4.2CVE-2024-39081EPSS 0.5%

    An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications.

  7. 8.7CVE-2024-43099EPSS 0.3%

    The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker…

  8. 7.3CVE-2024-8260EPSS 0.3%

    A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an…

  9. 8.2CVE-2024-3982EPSS 0.2%

    An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logg…

  10. 5.3CVE-2024-45244EPSS 0.6%

    Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

  11. 8.4CVE-2024-38890EPSS 0.2%

    An issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attacker to perform an Authentication Bypass by Capture-replay attack due to insufficient protection a…

  12. 7.5CVE-2024-5249EPSS 0.2%

    In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.

  13. 9.8CVE-2024-38438EPSS 0.7%

    D-Link - CWE-294: Authentication Bypass by Capture-replay

  14. 6.8CVE-2024-37016EPSS 0.3%

    Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach.

  15. 7.1CVE-2024-38272EPSS 0.2%

    There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if t…

  16. 8.7CVE-2024-38284EPSS 0.3%

    Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.

  17. 8.1CVE-2024-34065EPSS 0.7%

    Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unau…

  18. 7.3CVE-2024-4009EPSS 0.1%

    Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System

  19. 7.2CVE-2024-29851EPSS 0.9%

    Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.

  20. 8.8CVE-2024-29850EPSS 0.8%

    Veeam Backup Enterprise Manager allows account takeover via NTLM relay.

  21. 9.8CVE-2023-47435EPSS 0.6%

    An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages.

  22. 8.1CVE-2024-29901EPSS 0.7%

    The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched …

  23. 9.8CVE-2023-49231EPSS 43%

    An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token.

  24. 7.5CVE-2023-6374EPSS 0.8%

    Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illeg…

  25. 8.8CVE-2023-46892EPSS 0.3%

    The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions (e.g., the…

  26. 5.3CVE-2023-50128EPSS 0.2%

    The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attacker being able to conduct replay attacks to bring the alarm system to a disarmed…

  27. 8.1CVE-2022-46480EPSS 0.5%

    Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range.

  28. 8.8CVE-2023-39547EPSS 0.6%

    CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary comm…

  29. 8.1CVE-2023-45794EPSS 0.4%

    A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applica…

  30. 6.5CVE-2023-36857EPSS 0.4%

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.

  31. 7.5CVE-2023-41890EPSS 0.8%

    Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not suffi…

  32. 9.8CVE-2023-30909EPSS 1.5%

    A remote authentication bypass issue exists in some OneView APIs.

  33. 6.5CVE-2023-39373EPSS 0.3%

    A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.

  34. 7.5CVE-2023-20900EPSS 1.5%

    A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their pri…

  35. 8.1CVE-2023-34625EPSS 1.0%

    ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is vulnerable to replay attacks. A malicious user is able to intercept BLE request…

  36. 7.5CVE-2022-48507EPSS 0.4%

    Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect service confidentiality.

  37. 9.1CVE-2023-2846EPSS 1.3%

    Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by …

  38. 6.5CVE-2023-34553EPSS 0.3%

    An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack.

  39. 9.1CVE-2023-29158EPSS 0.6%

    SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data integrity.

  40. 5.9CVE-2023-33621EPSS 0.7%

    GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers…

  41. 7.5CVE-2023-31763EPSS 0.3%

    Weak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.

  42. 7.5CVE-2023-31762EPSS 0.3%

    Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack.

  43. 7.5CVE-2023-31761EPSS 0.3%

    Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.

  44. 7.5CVE-2023-31759EPSS 0.3%

    Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack.

  45. 6.5CVE-2023-33281EPSS 0.6%

    The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, which allows for a replay attack. NOTE: the vendor's position is that this cannot be reproduced with genuine Nissan parts: for exam…

  46. 6.8CVE-2022-47930EPSS 0.5%

    An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of …

  47. 4.6CVE-2023-20123EPSS 0.2%

    A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gai…

  48. 9.8CVE-2023-1886EPSS 0.9%

    Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

  49. 9.8CVE-2023-1537EPSS 0.8%

    Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.

  50. 9.8CVE-2023-23397KEVEPSS 97%

    Microsoft Outlook Elevation of Privilege Vulnerability