730
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to check for certificate
revocation
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-300: Channel Accessible by Non-Endpoint
Weakness ID : 300
Structure : Simple
Abstraction : Class
Description
The product does not adequately verify the identity of actors at both ends of a communication
channel, or does not adequately ensure the integrity of the channel, in a way that allows the
channel to be accessed or influenced by an actor that is not an endpoint.
Extended Description
In order to establish secure communication between two parties, it is often important to adequately
verify the identity of entities at each end of the communication channel. Inadequate or inconsistent
verification may result in insufficient or incorrect identification of either communicating entity. This
can have negative consequences such as misplaced trust in the entity at the other end of the
channel. An attacker can leverage this by interposing between the communicating entities and
masquerading as the original entity. In the absence of sufficient verification of identity, such an
attacker can eavesdrop and potentially modify the communication between the original entities.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 923 Improper Restriction of Communication Channel to Intended
Endpoints