CAPEC-387
Navigation Remapping To Propagate Malicious Content
2014-06-23
00h00 +00:00
00h00 +00:00
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
CAPEC の説明
An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.
CAPEC の情報
前提条件
Targeted software is utilizing application framework APIs必要なリソース
A software program that allows the use of adversary-in-the-middle communications between the client and server, such as a man-in-the-middle proxy.関連する弱点
| 弱点名 | |
|---|---|
CWE-471 |
Modification of Assumed-Immutable Data (MAID) The product does not properly protect an assumed-immutable element from being modified by an attacker. |
CWE-345 |
Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
CWE-346 |
Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
CWE-602 |
Client-Side Enforcement of Server-Side Security The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server. |
CWE-311 |
Missing Encryption of Sensitive Data The product does not encrypt sensitive or critical information before storage or transmission. |
参考文献
REF-327
So Many Ways [...]: Exploiting Facebook and YoVilleTom Stracener, Sean Barnum.
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Resources_Required | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Extended_Description |
