CWE-345 对数据真实性的验证不充分
Insufficient Verification of Data Authenticity
结构: Simple
Abstraction: Class
状态: Draft
被利用可能性: unkown
基本描述
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
相关缺陷
- cwe_Nature: ChildOf cwe_CWE_ID: 693 cwe_View_ID: 1000 cwe_Ordinal: Primary
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| ['Integrity', 'Other'] | ['Varies by Context', 'Unexpected State'] |
Notes
Relationship "origin validation" could fall under this. Maintenance The specific ways in which the origin is not properly identified should be laid out as separate weaknesses. In some sense, this is more like a category.
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Insufficient Verification of Data | ||
| OWASP Top Ten 2004 | A3 | CWE More Specific | Broken Authentication and Session Management |
| WASC | 12 | Content Spoofing |
相关攻击模式
- CAPEC-111
- CAPEC-141
- CAPEC-142
- CAPEC-148
- CAPEC-218
- CAPEC-384
- CAPEC-385
- CAPEC-386
- CAPEC-387
- CAPEC-388