732
}
By eavesdropping on the communication channel or posing as the endpoint, an attacker would be
able to read all of the transmitted data.
Observed Examples
Reference Description
CVE-2014-1266 chain: incorrect "goto" in Apple SSL product bypasses certificate validation,
allowing Adversry-in-the-Middle (AITM) attack (Apple "goto fail" bug).
CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) ->
CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong
Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
https://www.cve.org/CVERecord?id=CVE-2014-1266
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 884 CWE Cross-section 884 2567
MemberOf 956 SFP Secondary Cluster: Channel Attack 888 2397
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
The summary identifies multiple distinct possibilities, suggesting that this is a category that must
be broken into more specific weaknesses.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Man-in-the-middle (MITM)
WASC 32 Routing Detour
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC06-J Do not rely on the default automatic
signature verification provided by
URLClassLoader and java.util.jar
Related Attack Patterns
CAPEC-ID Attack Pattern Name
57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
94 Adversary in the Middle (AiTM)
466 Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy
589 DNS Blocking
590 IP Address Blocking
612 WiFi MAC Address Tracking
613 WiFi SSID Tracking
615 Evil Twin Wi-Fi Attack
662 Adversary in the Browser (AiTB)
References
CWE Version 4.14
CWE-301: Reflection Attack in an Authentication Protocol
CWE-301: Reflection Attack in an Authentication Protocol