1073
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1398 Comprehensive Categorization: Component Interaction 1400 2524
Notes
Theoretical
Request smuggling can be performed due to a multiple interpretation error, where the target is an
intermediary or monitor, via a consistency manipulation (Transfer-Encoding and Content-Length
headers).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER HTTP Request Smuggling
WASC 26 HTTP Request Smuggling
WASC 27 HTTP Response Smuggling
Related Attack Patterns
CAPEC-ID Attack Pattern Name
33 HTTP Request Smuggling
273 HTTP Response Smuggling
References
[REF-433]Chaim Linhart, Amit Klein, Ronen Heled and Steve Orrin. "HTTP Request Smuggling". <
https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf >.2023-04-07.
[REF-1273]Robert Auger. "HTTP Response Smuggling". 2011 February 1. < http://
projects.webappsec.org/w/page/13246930/HTTP%20Response%20Smuggling >.
[REF-1274]Dzevad Alibegovic. "HTTP Request Smuggling: Complete Guide to Attack Types and
Prevention". 2021 August 3. < https://brightsec.com/blog/http-request-smuggling-hrs/ >.
[REF-1275]Busra Demir. "A Pentester's Guide to HTTP Request Smuggling". 2020 October 5. <
https://www.cobalt.io/blog/a-pentesters-guide-to-http-request-smuggling >.
[REF-1276]Edi Kogan and Daniel Kerman. "HTTP Desync Attacks in the Wild and How to Defend
Against Them". 2019 October 9. < https://www.imperva.com/blog/http-desync-attacks-and-defencemethods/
>.
[REF-1277]James Kettle. "HTTP Desync Attacks: Request Smuggling Reborn". 2019 August 7. <
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn >.2023-04-07.
[REF-1278]PortSwigger. "HTTP request smuggling". < https://portswigger.net/web-security/requestsmuggling
>.2023-04-07.
CWE-446: UI Discrepancy for Security Feature
Weakness ID : 446
Structure : Simple
Abstraction : Class
Description
CWE Version 4.14
CWE-446: UI Discrepancy for Security Feature
CWE-446: UI Discrepancy for Security Feature