Contributors
Jeremiah Grossman
(WhiteHat Security)

Ofer Shezaf
(Breach Security ) [Project Leader]

The Web Hacking Incidents Database
Last update:07 November 2007

List of incidents of class Weak Password Recovery Validation

Other WASC threat classifications:
Abuse of Functionality, Brute Force, Content Spoofing, Credential/Session Prediction, Cross-site Scripting, Defacement, Denial of Service, Directory Indexing, HTTP Response Splitting, Information Leakage, Insufficient Anti-automation, Insufficient Authentication, Insufficient Authorization, Insufficient Process Validation, Insufficient Session Expiration, Known Vulnerabity, Misconfiguration, OS Commanding, Other, Path Traversal, Phishing, Predictable Resource Location, Redirection, SQL Injection, Unknown, Weak Password Recovery Validation, Worm

There are 4 incidents of class Weak Password Recovery Validation
WHID 2006-14: Forgotten password clues create hacker risk
Date: 20 March 2006
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Weak Password Recovery Validation

A UK Security Consulting firm reports that 54 UK sites that it has surveyed have flaws in the "forgotten password" feature.

References:

WHID 2005-32: Weak password recovery on Citrix's site
Date: 03 August 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Weak Password Recovery Validation

Weak password recovery procedure at Citrix

References:

WHID 2005-5: Paris Hilton's T-Mobile online account hacked
Date: 22 February 2005
Incident Type: Security Breach
WASC Threat Classification: Insufficient Authentication, OS Commanding, Weak Password Recovery Validation

Details remain sketchy, but news reports include social engineering, a guessable secret question for password recovery, and a known vulnerability is BEA WebLogic

References:

WHID 2003-3: User passwords could be stolid in Microsoft's Passport service
Date: 08 May 2003
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Weak Password Recovery Validation

References:



This work is licensed under the Creative Commons Attribution License. To view a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.
© Copyright 2005, Web Application Security Consortium. All rights reserved.