866
Reference Description
https://www.cve.org/CVERecord?id=CVE-2004-0892
CVE-2003-0981 Product records the reverse DNS name of a visitor in the logs, allowing
spoofing and resultant XSS.
https://www.cve.org/CVERecord?id=CVE-2003-0981
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 949 SFP Secondary Cluster: Faulty Endpoint Authentication 888 2395
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
CWE-350, CWE-247, and CWE-292 were merged into CWE-350 in CWE 2.5. CWE-247 was
originally derived from Seven Pernicious Kingdoms, CWE-350 from PLOVER, and CWE-292
from CLASP. All taxonomies focused closely on the use of reverse DNS for authentication of
incoming requests.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Improperly Trusted Reverse DNS
CLASP Trusting self-reported DNS name
Software Fault Patterns SFP29 Faulty endpoint authentication
Related Attack Patterns
CAPEC-ID Attack Pattern Name
73 User-Controlled Filename
89 Pharming
142 DNS Cache Poisoning
275 DNS Rebinding
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-351: Insufficient Type Distinction
Weakness ID : 351
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-351: Insufficient Type Distinction
CWE-351: Insufficient Type Distinction