861
conduct an attack. For example, if the generatePage() function in this code is resource intensive,
an attacker could flood the server with fake requests using an authorized IP and consume
significant resources. This could be a serious DoS attack even though the attacker would never see
the page's sensitive content.
Observed Examples
Reference Description
CVE-2001-0860 Product uses IP address provided by a client, instead of obtaining it from the
packet headers, allowing easier spoofing.
https://www.cve.org/CVERecord?id=CVE-2001-0860
CVE-2004-1950 Web product uses the IP address in the X-Forwarded-For HTTP header
instead of a server variable that uses the connecting IP address, allowing filter
bypass.
https://www.cve.org/CVERecord?id=CVE-2004-1950
CVE-2001-0908 Product logs IP address specified by the client instead of obtaining it from the
packet headers, allowing information hiding.
https://www.cve.org/CVERecord?id=CVE-2001-0908
CVE-2006-1126 PHP application uses IP address from X-Forwarded-For HTTP header, instead
of REMOTE_ADDR.
https://www.cve.org/CVERecord?id=CVE-2006-1126
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Use of Less Trusted Source
Related Attack Patterns
CAPEC-ID Attack Pattern Name
73 User-Controlled Filename
76 Manipulating Web Input to File System Calls
85 AJAX Footprinting
141 Cache Poisoning
142 DNS Cache Poisoning
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
Weakness ID : 349
Structure : Simple
Abstraction : Base
Description
The product, when processing trusted data, accepts any untrusted data that is also included with
the trusted data, treating the untrusted data as if it were trusted.
Relationships
CWE Version 4.14
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data