1185
CWE-494: Download of Code Without Integrity Check
Weakness ID : 494
Structure : Simple
Abstraction : Base
Description
The product downloads source code or an executable from a remote location and executes the
code without sufficiently verifying the origin and integrity of the code.
Extended Description
An attacker can execute malicious code by compromising the host server, performing DNS
spoofing, or modifying the code in transit.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 669 Incorrect Resource Transfer Between Spheres 1471
ChildOf 345 Insufficient Verification of Data Authenticity 851
CanFollow 79 Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')