CAPEC-383
Harvesting Information via API Event Monitoring
An adversary hosts an event within an application framework and then monitors the data exchanged during the course of the event for the purpose of harvesting any important data leaked during the transactions. One example could be harvesting lists of usernames or userIDs for the purpose of sending spam messages to those users. One example of this type of attack involves the adversary creating an event within the sub-application. Assume the adversary hosts a "virtual sale" of rare items. As other users enter the event, the attacker records via AiTM (CAPEC-94) proxy the user_ids and usernames of everyone who attends. The adversary would then be able to spam those users within the application using an automated script.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-383: Harvesting Information via API Event Monitoring: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/383.html and https://cve.bz/cve/capec/383?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The target software is utilizing application framework APIs
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data | Confidentiality | The adversary is able to gather information to potentially support further nefarious activities. |
Mitigations
Leverage encryption techniques during information transactions so as to protect them from attack patterns of this kind.
Weaknesses it exploits
- CWE-311 Missing Encryption of Sensitive Data
- CWE-319 Cleartext Transmission of Sensitive Information
- CWE-419 Unprotected Primary Channel
- CWE-602 Client-Side Enforcement of Server-Side Security
Recent CVEs with these weaknesses
- 6.8CVE-2026-18128
Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.
- 10.0CVE-2026-124600
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
- 8.1CVE-2026-115338
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
- 5.9CVE-2026-118795
Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
- 4.3CVE-2026-112369
IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
- 7.6CVE-2026-123497
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HT…
- 3.7CVE-2026-5345
HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. Th…
- 5.4CVE-2026-35110
HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in u…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
MITRE's words, unchanged: CAPEC-383 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.