857
(Execution with Unnecessary Privileges). There appears to be little usage of this term today,
except in the SecurityFocus vulnerability database, where the term is used for a variety of issues,
including web-browser problems that allow violation of the Same Origin Policy and improper
validation of the source of an incoming message.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Origin Validation Error
ISA/IEC 62443 Part 3-3 Req SR 2.12 RE(1)
ISA/IEC 62443 Part 4-1 Req SD-1
ISA/IEC 62443 Part 4-1 Req SR-2
ISA/IEC 62443 Part 4-1 Req SVV-1
ISA/IEC 62443 Part 4-2 Req CR 2.12 RE(1)
ISA/IEC 62443 Part 4-2 Req CR 3.1 RE(1)
Related Attack Patterns
CAPEC-ID Attack Pattern Name
21 Exploitation of Trusted Identifiers
59 Session Credential Falsification through Prediction
60 Reusing Session IDs (aka Session Replay)
75 Manipulating Writeable Configuration Files
76 Manipulating Web Input to File System Calls
89 Pharming
111 JSON Hijacking (aka JavaScript Hijacking)
141 Cache Poisoning
142 DNS Cache Poisoning
160 Exploit Script-Based APIs
384 Application API Message Manipulation via Man-in-the-Middle
385 Transaction or Event Tampering via Application API Manipulation
386 Application API Navigation Remapping
387 Navigation Remapping To Propagate Malicious Content
388 Application API Button Hijacking
510 SaaS User Request Forgery
References
[REF-324]Taimur Aslam. "A Taxonomy of Security Faults in the UNIX
Operating System". 1995 August 1. < http://cwe.mitre.org/documents/sources/
ATaxonomyofSecurityFaultsintheUNIXOperatingSystem%5BAslam95%5D.pdf >.
CWE-347: Improper Verification of Cryptographic Signature
Weakness ID : 347
Structure : Simple
Abstraction : Base
Description
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-347: Improper Verification of Cryptographic Signature
CWE-347: Improper Verification of Cryptographic Signature