CAPEC-212
Functionality Misuse
Mittel
Mittel
Stable
2014-06-23
00h00 +00:00
00h00 +00:00
2021-06-24
00h00 +00:00
00h00 +00:00
Benachrichtigung für ein CAPEC
Bleiben Sie über alle Änderungen zu einem bestimmten CAPEC informiert.
CAPEC-Beschreibungen
An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.
CAPEC-Informationen
Voraussetzungen
The adversary has the capability to interact with the application directly.The target system does not adequately implement safeguards to prevent misuse of authorized actions/processes.Erforderliche Kenntnisse
General computer knowledge about how applications are launched, how they interact with input/output, and how they are configured.Gegenmaßnahmen
Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functionality that can be manipulated for malicious purposes.When implementing security features, consider how they can be misused and compromised.
Verwandte Schwachstellen
| Name der Schwachstelle | |
|---|---|
CWE-1242 |
Inclusion of Undocumented Features or Chicken Bits The device includes chicken bits or undocumented features that can create entry points for unauthorized actors. |
CWE-1246 |
Improper Write Handling in Limited-write Non-Volatile Memories The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories. |
CWE-1281 |
Sequence of Processor Instructions Leads to Unexpected Behavior Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed. |
Einreichung
| Name | Organisation | Datum | Veröffentlichungsdatum |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Änderungen
| Name | Organisation | Datum | Kommentar |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Description Summary, Typical_Likelihood_of_Exploit, Typical_Severity | |
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Solutions_and_Mitigations | |
| CAPEC Content Team | The MITRE Corporation | Updated Attacker_Skills_or_Knowledge_Required | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
