CWE-345: Insufficient Verification of Data Authenticity
Description
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- IntegrityOther
Varies by Context; Unexpected State
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-346Origin Validation Error
- CWE-347Improper Verification of Cryptographic Signature
- CWE-348Use of Less Trusted Source
- CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
- CWE-351Insufficient Type Distinction
- CWE-352Cross-Site Request Forgery (CSRF)
- CWE-353Missing Support for Integrity Check
- CWE-354Improper Validation of Integrity Check Value
- CWE-360Trust of System Event Data
- CWE-494Download of Code Without Integrity Check
- CWE-616Incomplete Identification of Uploaded File Variables (PHP)
- CWE-646Reliance on File Name or Extension of Externally-Supplied File
- CWE-649Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
- CWE-924Improper Enforcement of Message Integrity During Transmission in a Communication Channel
- CWE-1293Missing Source Correlation of Multiple Independent Data
CAPEC attack patterns that exploit it
- CAPEC-111JSON Hijacking (aka JavaScript Hijacking)
- CAPEC-141Cache Poisoning
- CAPEC-142DNS Cache Poisoning
- CAPEC-148Content Spoofing
- CAPEC-218Spoofing of UDDI/ebXML Messages
- CAPEC-384Application API Message Manipulation via Man-in-the-Middle
- CAPEC-385Transaction or Event Tampering via Application API Manipulation
- CAPEC-386Application API Navigation Remapping
- CAPEC-387Navigation Remapping To Propagate Malicious Content
- CAPEC-388Application API Button Hijacking
- CAPEC-665Exploitation of Thunderbolt Protection Flaws
- CAPEC-701Browser in the Middle (BiTM)