CWE-346: Origin Validation Error
Description
The product does not properly verify that the source of data or communication is valid.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access ControlOther
Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Related weaknesses
CAPEC attack patterns that exploit it
- CAPEC-21Exploitation of Trusted Identifiers
- CAPEC-59Session Credential Falsification through Prediction
- CAPEC-60Reusing Session IDs (aka Session Replay)
- CAPEC-75Manipulating Writeable Configuration Files
- CAPEC-76Manipulating Web Input to File System Calls
- CAPEC-89Pharming
- CAPEC-111JSON Hijacking (aka JavaScript Hijacking)
- CAPEC-141Cache Poisoning
- CAPEC-142DNS Cache Poisoning
- CAPEC-160Exploit Script-Based APIs
- CAPEC-384Application API Message Manipulation via Man-in-the-Middle
- CAPEC-385Transaction or Event Tampering via Application API Manipulation
- CAPEC-386Application API Navigation Remapping
- CAPEC-387Navigation Remapping To Propagate Malicious Content
- CAPEC-388Application API Button Hijacking
- CAPEC-510SaaS User Request Forgery