1123
Reference Description
CVE-2005-1905 Gain privileges by modifying assumed-immutable code addresses that are
accessed by a driver.
https://www.cve.org/CVERecord?id=CVE-2005-1905
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 991 SFP Secondary Cluster: Tainted Input to Environment 888 2416
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
MAID issues can be primary to many other weaknesses, and they are a major factor
in languages that provide easy access to internal program constructs, such as PHP's
register_globals and similar features. However, MAID issues can also be resultant from
weaknesses that modify internal state; for example, a program might validate some data and
store it in memory, but a buffer overflow could overwrite that validated data, leading to a change
in program logic.
Theoretical
There are many examples where the MUTABILITY property is a major factor in a vulnerability.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Modification of Assumed-Immutable
Data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
384 Application API Message Manipulation via Man-in-the-Middle
385 Transaction or Event Tampering via Application API Manipulation
386 Application API Navigation Remapping
387 Navigation Remapping To Propagate Malicious Content
388 Application API Button Hijacking
CWE-472: External Control of Assumed-Immutable Web Parameter
Weakness ID : 472
Structure : Simple
Abstraction : Base
Description
The web application does not sufficiently verify inputs that are assumed to be immutable but are
actually externally controllable, such as hidden form fields.
Extended Description
If a web product does not properly protect assumed-immutable values from modification in hidden
form fields, parameters, cookies, or URLs, this can lead to modification of critical data. Web
CWE Version 4.14
CWE-472: External Control of Assumed-Immutable Web Parameter
CWE-472: External Control of Assumed-Immutable Web Parameter