cve.bz

CAPEC-648

Collect Data from Screen Capture

Medium severityMedium likelihoodDetailed pattern

An adversary gathers sensitive information by exploiting the system's screen capture functionality. Through screenshots, the adversary aims to see what happens on the screen over the course of an operation. The adversary can leverage information gathered in order to carry out further attacks.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-648: Collect Data from Screen Capture: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/648.html and https://cve.bz/cve/capec/648?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

Prerequisites

  • The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).

Skills required

  • Low skill

    Once the adversary has logical access (which can potentially require high knowledge and skill level), the adversary needs only to leverage the relevant command for screen capture.

Resources required

  • None: No specialized resources are required to execute this type of attack.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Read DataConfidentialityThe adversary is able to capture potentially sensitive information and processes as they appear on the screen.

Mitigations

  • Identify potentially malicious software that may have functionality to acquire screen captures, and audit and/or block it by using allowlist tools.

  • While screen capture is a legitimate and practical function, certain situations and context may require the disabling of this feature.

Weaknesses it exploits

  • CWE-267 Privilege Defined With Unsafe Actions

Recent CVEs with these weaknesses

  1. 8.8CVE-2026-12977

    A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive…

  2. 7.2CVE-2026-114524

    Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

  3. 8.1CVE-2026-57202

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read…

  4. 4.3CVE-2026-96390

    Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

  5. 5.4CVE-2026-96371

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  6. 4.6CVE-2026-96367

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  7. 3.1CVE-2026-96363

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

  8. 9.3CVE-2026-109520

    A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer c…

The newest records naming one of them. Each weakness's page lists them all.

Part of
  • CAPEC-150 Collect Data from Common Resource Locations

MITRE's words, unchanged: CAPEC-648 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.