CAPEC の説明
An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.
CAPEC の情報
前提条件
An adversary requires some way of interacting with the system.必要なリソース
A tool, such as an Adversary in the Middle (CAPEC-94) Proxy or a fuzzer, that is capable of generating and injecting custom inputs to be used in the attack.緩和策
Minimize error/response output to only what is necessary for functional use or corrective language.Remove potentially sensitive information that is not necessary for the application's functionality.
関連する弱点
| 弱点名 | |
|---|---|
CWE-200 |
Exposure of Sensitive Information to an Unauthorized Actor The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
CWE-1243 |
Sensitive Non-Volatile Information Not Protected During Debug Access to security-sensitive information stored in fuses is not limited during debug. |
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Activation_Zone, Attack_Prerequisites, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact | |
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Other_Notes, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Resources_Required | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Extended_Description |
