CWE-941 Details

CWE-941

Incorrectly Specified Destination in a Communication Channel
Incomplete
2014-02-19
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Benachrichtigungen für ein CWE
Bleiben Sie über alle Änderungen zu einem bestimmten CWE informiert.
Benachrichtigungen verwalten

Name: Incorrectly Specified Destination in a Communication Channel

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Allgemeine Informationen

Einführungsmodi

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Anwendbare Plattformen

Sprache

Class: Not Language-Specific (Undetermined)

Technologien

Class: Mobile (Undetermined)

Häufige Konsequenzen

Bereich Auswirkung Wahrscheinlichkeit
Access Control
Other		Gain Privileges or Assume Identity, Varies by Context, Bypass Protection Mechanism

Note: An attacker can access any functionality that is inadvertently accessible to the source.

Beobachtete Beispiele

Referenzen Beschreibung

CVE-2013-5211

composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses.

CVE-1999-0513

Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses.

CVE-1999-1379

DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker.

Hinweise zur Schwachstellen-Zuordnung

Begründung : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Kommentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Referenzen

REF-941

UDP-based Amplification Attacks
US-CERT.
https://www.cisa.gov/ncas/alerts/TA14-017A

REF-942

Android Bad Practices: Sticky Broadcast
Fortify.
https://www.hpe.com/us/en/solutions/infrastructure-security.html?jumpid=va_wnmstr1ug6_aid-510326901

Einreichung

Name Organisation Datum Veröffentlichungsdatum Version
CWE Content Team MITRE 2014-02-13 +00:00 2014-02-19 +00:00 2.6

Änderungen

Name Organisation Datum Kommentar
CWE Content Team MITRE 2017-11-08 +00:00 updated Modes_of_Introduction, References, Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Applicable_Platforms, Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated Maintenance_Notes
CWE Content Team MITRE 2023-01-31 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-09-09 +00:00 updated References
CWE Content Team MITRE 2025-12-11 +00:00 updated Common_Consequences, Relationships, Weakness_Ordinalities
Die auf CVE Find präsentierten Informationen stammen aus mehreren sorgfältig ausgewählten Referenzquellen. CVE-Daten werden von der MITRE Corporation und der National Vulnerability Database (NVD) bereitgestellt. Der Katalog bekannter ausgenutzter Schwachstellen (KEV) stammt von der Cybersecurity and Infrastructure Security Agency (CISA), während EPSS-Scores von FIRST.org kommen. Darüber hinaus werden Daten zu Software-Schwachstellen (CWE) und häufigen Angriffsmustern (CAPEC) von der MITRE Corporation gepflegt, und Informationen zu Hardware- und Software-Konfigurationen (CPE) werden von der NVD bereitgestellt.