858
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1214 Data Integrity Issues 2477
MemberOf 310 Cryptographic Issues 2318
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control
Integrity
Confidentiality
Gain Privileges or Assume Identity
Modify Application Data
Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and
possibly execute unauthorized code.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
In the following code, a JarFile object is created from a downloaded file.
Example Language: Java (Bad)
File f = new File(downloadedFilePath);
JarFile jf = new JarFile(f);
The JAR file that was potentially downloaded from an untrusted source is created without verifying
the signature (if present). An alternate constructor that accepts a boolean verify parameter should
be used instead.
Observed Examples
Reference Description
CVE-2002-1796 Does not properly verify signatures for "trusted" entities.
https://www.cve.org/CVERecord?id=CVE-2002-1796
CWE Version 4.14
CWE-348: Use of Less Trusted Source
CWE-348: Use of Less Trusted Source