1846
attack and for conducting a distributed denial of service (DDoS). As another example, serverside
request forgery (SSRF) and XML External Entity (XXE) can be used to trick a server into
making outgoing requests to hosts that cannot be directly accessed by the attacker due to
firewall restrictions.
• If the product incorrectly specifies the destination, then an attacker who can control this
destination might be able to spoof trusted servers. While the most common occurrence
is likely due to misconfiguration by an administrator, this can be resultant from other
weaknesses. For example, the product might incorrectly parse an e-mail or IP address and
send sensitive data to an unintended destination. As another example, an Android application
may use a "sticky broadcast" to communicate with a receiver for a particular application,
but since sticky broadcasts can be processed by *any* receiver, this can allow a malicious
application to access restricted data that was only intended for a different application.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 923 Improper Restriction of Communication Channel to Intended
Endpoints