874
CAPEC-ID Attack Pattern Name
111 JSON Hijacking (aka JavaScript Hijacking)
462 Cross-Domain Search Timing
467 Cross Site Identification
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-329]Peter W. "Cross-Site Request Forgeries (Re: The Dangers of Allowing Users to Post
Images)". Bugtraq. < http://marc.info/?l=bugtraq&m=99263135911884&w=2 >.
[REF-330]OWASP. "Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet". < http://
www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet >.
[REF-331]Edward W. Felten and William Zeller. "Cross-Site Request Forgeries: Exploitation
and Prevention". 2008 October 8. < https://citeseerx.ist.psu.edu/viewdoc/summary?
doi=10.1.1.147.1445 >.2023-04-07.
[REF-332]Robert Auger. "CSRF - The Cross-Site Request Forgery (CSRF/XSRF) FAQ". < https://
www.cgisecurity.com/csrf-faq.html >.2023-04-07.
[REF-333]"Cross-site request forgery". 2008 December 2. Wikipedia. < https://en.wikipedia.org/
wiki/Cross-site_request_forgery >.2023-04-07.
[REF-334]Jason Lam. "Top 25 Series - Rank 4 - Cross Site Request Forgery". 2010 March 3.
SANS Software Security Institute. < http://software-security.sans.org/blog/2010/03/03/top-25-
series-rank-4-cross-site-request-forgery >.
[REF-335]Jeff Atwood. "Preventing CSRF and XSRF Attacks". 2008 October 4. < https://
blog.codinghorror.com/preventing-csrf-and-xsrf-attacks/ >.2023-04-07.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-956]Wikipedia. "Samy (computer worm)". < https://en.wikipedia.org/wiki/
Samy_(computer_worm) >.2018-01-16.
CWE-353: Missing Support for Integrity Check
Weakness ID : 353
Structure : Simple
Abstraction : Base
Description
The product uses a transmission protocol that does not include a mechanism for verifying the
integrity of the data during transmission, such as a checksum.
Extended Description
If integrity check values or "checksums" are omitted from a protocol, there is no way of determining
if data has been corrupted in transmission. The lack of checksum functionality in a protocol
removes the first application-level check of data that can be used. The end-to-end philosophy
of checks states that integrity checks should be performed at the lowest level that they can be
completely implemented. Excluding further sanity checks and input validation performed by
applications, the protocol's checksum is the most important level of checksum, since it can be
performed more completely than at any previous level and takes into account entire messages, as
opposed to single packets.
Relationships
CWE Version 4.14
CWE-353: Missing Support for Integrity Check
CWE-353: Missing Support for Integrity Check