CVE-2023-4094

Detects unauthorized successful logons resulting from improper authentication implementations.

Documented IA policy and procedures require proper authentication mechanisms to be defined and followed, reducing improper authentication.

Requires adaptive authentication under specific conditions, directly strengthening authentication mechanisms against improper or insufficient authentication.

Requires unique identification and authentication of organizational users, directly preventing improper authentication.

Directly requires implementation of compliant authentication mechanisms to cryptographic modules, preventing improper authentication.

Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.

Security awareness training instructs users on secure authentication practices and avoiding credential compromise.

Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.

Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.

A.5.17 directly mandates non-guessable unique secrets, identity verification before issuance, secure transmission, immediate default changes, strong password enforcement, no reuse, and protected storage/transmission, which stops exploitation of most insufficient-proof cases in CWE-1390; the bounded remainder is non-password mechanisms (e.g. biometrics, certificates) or flawed protocol-level proof not covered by these password-centric rules.

Security requirements specified early and verified through testing drive the consistent implementation of authentication mechanisms, decreasing the likelihood that authentication steps are omitted or incorrectly applied.

A.8.26 explicitly requires identifying and addressing authentication-related requirements (including level of trust in identity via 8.5 and 5.17) as part of application development or acquisition, which prevents a slice of CWE-287 but leaves the dominant sufficiency-of-proof aspects (IA-2/IA-5) and many implementation defects untouched.

A.8.27 mandates security-by-design principles (least privilege, default-deny, never-trust/always-verify, MFA, end-to-end encryption of requests, distrust-external-input, secure session control, and explicit authentication/authorization in every layer), which directly stops most improper-authentication flaws from being exploitable; the bounded remainder is insufficient-proof cases that live only in the strength or correctness of the credential itself (IA-5/IA-2 territory).

A.8.5 directly mandates choosing sufficiently strong authentication techniques (including MFA, biometrics with fallback, brute-force protection, secure log-on procedures) that prove claimed identity, which stops exploitation of insufficient proof for most but not all cases in CWE-1390 (e.g. residual protocol-level or implementation-specific flaws remain possible).