1715
The product uses a protection mechanism that relies on the existence or values of an input, but the
input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Extended Description
Developers may assume that inputs such as cookies, environment variables, and hidden form
fields cannot be modified. However, an attacker could change these inputs using customized
clients or other attacks. This change might not be detected. When security decisions such as
authentication and authorization are made based on the values of these inputs, attackers can
bypass the security of the software.
Without sufficient encryption, integrity checking, or other mechanism, any input that originates from
an outsider cannot be trusted.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
ParentOf 302 Authentication Bypass by Assumed-Immutable Data 735
ParentOf 350 Reliance on Reverse DNS Resolution for a Security-Critical
Action