CWE-941 Detail

CWE-941

Incorrectly Specified Destination in a Communication Channel
Incomplete
2014-02-19
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Meldingen voor een CWE
Blijf op de hoogte van wijzigingen voor een specifieke CWE.
Meldingen beheren

Naam: Incorrectly Specified Destination in a Communication Channel

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Algemene informatie

Introductiemodi

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Toepasselijke platforms

Taal

Class: Not Language-Specific (Undetermined)

Technologieën

Class: Mobile (Undetermined)

Veelvoorkomende gevolgen

Bereik Impact Waarschijnlijkheid
Access Control
Other		Gain Privileges or Assume Identity, Varies by Context, Bypass Protection Mechanism

Note: An attacker can access any functionality that is inadvertently accessible to the source.

Waargenomen voorbeelden

Referenties Beschrijving

CVE-2013-5211

composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses.

CVE-1999-0513

Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses.

CVE-1999-1379

DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker.

Notities kwetsbaarheidsmapping

Rechtvaardiging : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Opmerking : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Referenties

REF-941

UDP-based Amplification Attacks
US-CERT.
https://www.cisa.gov/ncas/alerts/TA14-017A

REF-942

Android Bad Practices: Sticky Broadcast
Fortify.
https://www.hpe.com/us/en/solutions/infrastructure-security.html?jumpid=va_wnmstr1ug6_aid-510326901

Indiening

Naam Organisatie Datum Releasedatum Version
CWE Content Team MITRE 2014-02-13 +00:00 2014-02-19 +00:00 2.6

Wijzigingen

Naam Organisatie Datum Opmerking
CWE Content Team MITRE 2017-11-08 +00:00 updated Modes_of_Introduction, References, Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Applicable_Platforms, Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated Maintenance_Notes
CWE Content Team MITRE 2023-01-31 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-09-09 +00:00 updated References
CWE Content Team MITRE 2025-12-11 +00:00 updated Common_Consequences, Relationships, Weakness_Ordinalities
De informatie die op CVE Find wordt gepresenteerd, is afkomstig van verschillende zorgvuldig geselecteerde referentiebronnen. CVE-gegevens worden geleverd door MITRE Corporation en de National Vulnerability Database (NVD). De Known Exploited Vulnerabilities (KEV)-catalogus is afkomstig van de Cybersecurity and Infrastructure Security Agency (CISA), terwijl EPSS-scores afkomstig zijn van FIRST.org. Daarnaast worden gegevens over softwarezwakheden (CWE) en veelvoorkomende aanvalspatronen (CAPEC) bijgehouden door MITRE Corporation, en informatie over hardware- en softwareconfiguraties (CPE) wordt geleverd door de NVD.