1831
Nature Type ID Name Page
MemberOf 1214 Data Integrity Issues 2477
MemberOf 417 Communication Channel Errors 2325
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Gain Privileges or Assume Identity
If an attackers can spoof the endpoint, the attacker
gains all the privileges that were intended for the original
endpoint.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Notes
Maintenance
This entry should be made more comprehensive in later CWE versions, as it is likely an
important design flaw that underlies (or chains to) other weaknesses.
CWE-925: Improper Verification of Intent by Broadcast Receiver
Weakness ID : 925
Structure : Simple
Abstraction : Variant
Description
The Android application uses a Broadcast Receiver that receives an Intent but does not properly
verify that the Intent came from an authorized source.
Extended Description
Certain types of Intents, identified by action string, can only be broadcast by the operating system
itself, not by third-party applications. However, when an application registers to receive these
implicit system intents, it is also registered to receive any explicit intents. While a malicious
application cannot send an implicit system intent, it can send an explicit intent to the target
application, which may assume that any received intent is a valid implicit system intent and not an
explicit intent from another application. This may lead to unintended behavior.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-925: Improper Verification of Intent by Broadcast Receiver
CWE-925: Improper Verification of Intent by Broadcast Receiver