CWE
Home > CWE List > CWE-345 Individual Dictionary Definition (Draft 9)   View the CWE List

CWE-345 Individual Dictionary Definition (Draft 9)

Insufficient Verification of Data Authenticity
Weakness ID
Status: Draft

345 (Weakness Class)

Description

Summary

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Context Notes

Terminology Note: "origin validation" could fall under this.

Relationships
NatureTypeIDName
ChildOfCategoryCategory254Security Features
ParentOfWeakness VariantWeakness VariantWeakness Variant247Reliance on DNS Lookups in a Security Decision
CanAlsoBeWeakness BaseWeakness BaseWeakness Base283Unverified Ownership
ParentOfWeakness BaseWeakness BaseWeakness Base297Failure to Validate Host-specific Certificate Data
CanAlsoBeWeakness BaseWeakness BaseWeakness Base304Missing Critical Step in Authentication
ParentOfWeakness BaseWeakness BaseWeakness Base322Key Exchange without Entity Authentication
ParentOfWeakness BaseWeakness BaseWeakness Base346Origin Validation Error
ParentOfWeakness BaseWeakness BaseWeakness Base347Improperly Verified Signature
ParentOfWeakness BaseWeakness BaseWeakness Base348Use of Less Trusted Source
ParentOfWeakness BaseWeakness BaseWeakness Base349Acceptance of Extraneous Untrusted Data With Trusted Data
ParentOfWeakness BaseWeakness BaseWeakness Base350Improperly Trusted Reverse DNS
ParentOfWeakness BaseWeakness BaseWeakness Base351Insufficient Type Distinction
ParentOfWeakness BaseWeakness BaseWeakness Base353Failure to Add Integrity Check Value
ParentOfWeakness BaseWeakness BaseWeakness Base354Failure to Check Integrity Check Value
CanAlsoBeWeakness BaseWeakness BaseWeakness Base358Improperly Implemented Security Check for Standard
ParentOfWeakness VariantWeakness VariantWeakness Variant646Taking Actions based on File Name or Extension of a User Supplied File
ParentOfWeakness BaseWeakness BaseWeakness Base649Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
ParentOfCompound Element: CompositeCompound Element: Composite352Cross-Site Request Forgery (CSRF)
Source Taxonomies

PLOVER - Insufficient Verification of Data

Applicable Platforms

All

Related Attack Patterns
CAPEC-IDAttack Pattern Name
4Using Alternative IP Address Encodings
Back to top
Page Last Updated: April 22, 2008
 

CWE is sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us