2113
Reference Description
CVE-2022-24045 Web application for a room automation system has client-side JavaScript that
sets a sensitive cookie without the SameSite security attribute, allowing the
cookie to be sniffed
https://www.cve.org/CVERecord?id=CVE-2022-24045
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
62 Cross Site Request Forgery
References
[REF-1104]M. West and M. Goodwin. "SameSite attribute specification draft". 2016 April 6. <
https://datatracker.ietf.org/doc/html/draft-west-first-party-cookies-07 >.2023-04-07.
[REF-1105]Mozilla. "SameSite attribute description on MDN Web Docs". 2020 June 0. < https://
developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite >.
[REF-1106]The Chromium Projects. "Chromium support for SameSite attribute". 2019 September
6. < https://www.chromium.org/updates/same-site/ >.2023-04-07.
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System
Weakness ID : 1276
Structure : Simple
Abstraction : Base
Description
Signals between a hardware IP and the parent system design are incorrectly connected causing
security risks.
Extended Description
Individual hardware IP must communicate with the parent system in order for the product to
function correctly and as intended. If implemented incorrectly, while not causing any apparent
functional issues, may cause security issues. For example, if the IP should only be reset by a
system-wide hard reset, but instead the reset input is connected to a software-triggered debug
mode reset (which is also asserted during a hard reset), integrity of data inside the IP can be
violated.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System