CWE-302: Authentication Bypass by Assumed-Immutable Data
Description
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Access Control
Bypass Protection Mechanism
Potential mitigations
- Architecture and DesignOperationImplementation
Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
Related weaknesses
CAPEC attack patterns that exploit it
- CAPEC-10Buffer Overflow via Environment Variables
- CAPEC-13Subverting Environment Variable Values
- CAPEC-21Exploitation of Trusted Identifiers
- CAPEC-31Accessing/Intercepting/Modifying HTTP Cookies
- CAPEC-39Manipulating Opaque Client-based Data Tokens
- CAPEC-45Buffer Overflow via Symbolic Links
- CAPEC-77Manipulating User-Controlled Variables
- CAPEC-274HTTP Verb Tampering