710
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Trusting self-reported IP address
Related Attack Patterns
CAPEC-ID Attack Pattern Name
4 Using Alternative IP Address Encodings
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-1371]"IP address spoofing". 2006 April 7. Wikipedia. < https://en.wikipedia.org/wiki/
IP_address_spoofing >.2023-10-21.
CWE-293: Using Referer Field for Authentication
Weakness ID : 293
Structure : Simple
Abstraction : Variant
Description
The referer field in HTTP requests can be easily modified and, as such, is not a valid means of
message integrity checking.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 290 Authentication Bypass by Spoofing 705
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Background Details
The referer field in HTML requests can be simply modified by malicious users, rendering it useless
as a means of checking the validity of the request in question.
Alternate Terms
referrer : While the proper spelling might be regarded as "referrer," the HTTP RFCs and their
implementations use "referer," so this is regarded as the correct spelling.
Likelihood Of Exploit
High
CWE Version 4.14
CWE-293: Using Referer Field for Authentication
CWE-293: Using Referer Field for Authentication