856
Because the application does not check the source, a malicious website loaded within this
WebView has the same access to the API as a trusted site.
Observed Examples
Reference Description
CVE-2000-1218 DNS server can accept DNS updates from hosts that it did not query, leading
to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2000-1218
CVE-2005-0877 DNS server can accept DNS updates from hosts that it did not query, leading
to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2005-0877
CVE-2001-1452 DNS server caches glue records received from non-delegated name servers
https://www.cve.org/CVERecord?id=CVE-2001-1452
CVE-2005-2188 user ID obtained from untrusted source (URL)
https://www.cve.org/CVERecord?id=CVE-2005-2188
CVE-2003-0174 LDAP service does not verify if a particular attribute was set by the LDAP
server
https://www.cve.org/CVERecord?id=CVE-2003-0174
CVE-1999-1549 product does not sufficiently distinguish external HTML from internal,
potentially dangerous HTML, allowing bypass using special strings in the page
title. Overlaps special elements.
https://www.cve.org/CVERecord?id=CVE-1999-1549
CVE-2003-0981 product records the reverse DNS name of a visitor in the logs, allowing
spoofing and resultant XSS.
https://www.cve.org/CVERecord?id=CVE-2003-0981
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 949 SFP Secondary Cluster: Faulty Endpoint Authentication 888 2395
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1382 ICS Operations (& Maintenance): Emerging Energy
Technologies
1358 2517
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Notes
Maintenance
This entry has some significant overlap with other CWE entries and may need some clarification.
See terminology notes.
Terminology
The "Origin Validation Error" term was originally used in a 1995 thesis [REF-324]. Although not
formally defined, an issue is considered to be an origin validation error if either (1) "an object
[accepts] input from an unauthorized subject," or (2) "the system [fails] to properly or completely
authenticate a subject." A later section says that an origin validation error can occur when
the system (1) "does not properly authenticate a user or process" or (2) "does not properly
authenticate the shared data or libraries." The only example provided in the thesis (covered by
OSVDB:57615) involves a setuid program running command-line arguments without dropping
privileges. So, this definition (and its examples in the thesis) effectively cover other weaknesses
such as CWE-287 (Improper Authentication), CWE-285 (Improper Authorization), and CWE-250
CWE Version 4.14
CWE-347: Improper Verification of Cryptographic Signature
CWE-347: Improper Verification of Cryptographic Signature