Category-1020: 验证消息完整性

  • A+
所属分类:CWE(弱点枚举)

Category-1020: 验证消息完整性

ID: 1020
Status: Draft

Summary

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Membership

ID NAME
CWE-353 缺失完整性检查支持
CWE-354 完整性检查值验证不恰当
CWE-390 未有动作错误条件的检测
CWE-391 未经检查的错误条件
CWE-494 下载代码缺少完整性检查
CWE-565 在信任Cookie未进行验证与完整性检查
CWE-649 依赖于未经完整性检查的安全相关输入的混淆或加密
CWE-707 对消息或数据结构的处理不恰当
CWE-755 对异常条件的处理不恰当
CWE-924 通信信道中传输过程中消息完整性的不正确执行

References

REF-9 A Catalog of Security Architecture Weaknesses.
REF-10 Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.

文章来源于互联网:scap中文网

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: