2204
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
Common data types that are attacked are environment
variables, web application parameters, and HTTP headers.
Integrity Unexpected State
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Phase: Implementation
When the data is stored or transmitted through untrusted sources that could modify the data,
implement integrity checks to detect unauthorized modification, or store/transmit the data in a
trusted location that is free from external influence.
Demonstrative Examples
Example 1:
In the code excerpt below, an array returned by a Java method is modified despite the fact that
arrays are mutable.
Example Language: Java (Bad)
String[] colors = car.getAllPossibleColors();
colors[0] = "Red";
Observed Examples
Reference Description
CVE-2002-1757 Relies on $PHP_SELF variable for authentication.
https://www.cve.org/CVERecord?id=CVE-2002-1757
CWE Version 4.14
CWE-472: External Control of Assumed-Immutable Web Parameter
CWE-472: External Control of Assumed-Immutable Web Parameter