876
outSock.send(sp);
}
The response containing secret data has no integrity check associated with it, allowing an attacker
to alter the message without detection.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 957 SFP Secondary Cluster: Protocol Error 888 2398
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to add integrity check value
ISA/IEC 62443 Part 2-4 Req SP.03.03 RE(1)
ISA/IEC 62443 Part 2-4 Req SP.04.02 RE(1)
ISA/IEC 62443 Part 2-4 Req SP.11.06 RE(2)
ISA/IEC 62443 Part 3-3 Req SR 3.1
ISA/IEC 62443 Part 4-1 Req SD-1
ISA/IEC 62443 Part 4-2 Req CR 3.1
Related Attack Patterns
CAPEC-ID Attack Pattern Name
13 Subverting Environment Variable Values
14 Client-side Injection-induced Buffer Overflow
39 Manipulating Opaque Client-based Data Tokens
74 Manipulating State
75 Manipulating Writeable Configuration Files
389 Content Spoofing Via Application API Manipulation
665 Exploitation of Thunderbolt Protection Flaws
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-354: Improper Validation of Integrity Check Value
Weakness ID : 354
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-354: Improper Validation of Integrity Check Value
CWE-354: Improper Validation of Integrity Check Value