CVE-2023-20046

Training instructs users on protecting credentials from disclosure or unauthorized access.

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.

Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.

Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.

Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.

Proper identity management reduces alternate-name collisions but does not guarantee canonicalization inside the auth decision.

Strong authentication mechanisms directly prevent name-based bypass when they enforce canonical name checks.

Authorization policy enforcement assumes correct identity; the weakness occurs before policy is applied.

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.

A.5.15 only requires defining and documenting an access control policy plus requirements; it does not itself enforce rules or stop alternate-name authentication bypasses from being exploitable.

A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it has no bearing on a product that authenticates by name but fails to canonicalize or check alternate names for the same resource/actor, so the weakness remains present and exploitable.

Proper management of authentication credentials can include rules against duplicate or alias identities.

A.5.18 governs the provisioning, review, and revocation of already-granted access rights to authenticated identities; it does not address or stop the distinct flaw in which authentication logic accepts an alternate name that bypasses the check.

A.6.2 sets contractual terms, NDAs, and communicates responsibilities to personnel; it has no technical effect on how credentials are protected in transmission or storage and cannot stop exploitation of CWE-522