853
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 949 SFP Secondary Cluster: Faulty Endpoint Authentication 888 2395
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Notes
Relationship
"origin validation" could fall under this.
Maintenance
The specific ways in which the origin is not properly identified should be laid out as separate
weaknesses. In some sense, this is more like a category.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insufficient Verification of Data
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
WASC 12 Content Spoofing
Related Attack Patterns
CAPEC-ID Attack Pattern Name
111 JSON Hijacking (aka JavaScript Hijacking)
141 Cache Poisoning
142 DNS Cache Poisoning
148 Content Spoofing
218 Spoofing of UDDI/ebXML Messages
384 Application API Message Manipulation via Man-in-the-Middle
385 Transaction or Event Tampering via Application API Manipulation
386 Application API Navigation Remapping
387 Navigation Remapping To Propagate Malicious Content
388 Application API Button Hijacking
665 Exploitation of Thunderbolt Protection Flaws
701 Browser in the Middle (BiTM)
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
CWE-346: Origin Validation Error
CWE Version 4.14
CWE-346: Origin Validation Error
CWE-346: Origin Validation Error