CWE-345 对数据真实性的验证不充分

Insufficient Verification of Data Authenticity

结构: Simple

Abstraction: Class

状态: Draft

被利用可能性: unkown

基本描述

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 693 cwe_View_ID: 1000 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
['Integrity', 'Other']	['Varies by Context', 'Unexpected State']

Notes

Relationship
"origin validation" could fall under this.
Maintenance
The specific ways in which the origin is not properly identified should be laid out as separate weaknesses. In some sense, this is more like a category.

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Insufficient Verification of Data
OWASP Top Ten 2004	A3	CWE More Specific	Broken Authentication and Session Management
WASC	12		Content Spoofing

相关攻击模式

• CAPEC-111
• CAPEC-141
• CAPEC-142
• CAPEC-148
• CAPEC-218
• CAPEC-384
• CAPEC-385
• CAPEC-386
• CAPEC-387
• CAPEC-388

引用

• REF-44 24 Deadly Sins of Software Security

文章来源于互联网:scap中文网