CWE-300: Channel Accessible by Non-Endpoint, page 2
Filter
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
What the weakness is: CWE-300 at MITRE. OWASP Top 10: A07:2025 Authentication Failures
Related attack patterns (CAPEC): 9
- CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Likelihood: Medium · Severity: Very High
- CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
- CAPEC-466 Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy Severity: Medium
- CAPEC-589 DNS Blocking
- CAPEC-590 IP Address Blocking Likelihood: Low · Severity: High
- CAPEC-612 WiFi MAC Address Tracking Severity: Low
- CAPEC-613 WiFi SSID Tracking Severity: Low
- CAPEC-615 Evil Twin Wi-Fi Attack Severity: Low
- CAPEC-662 Adversary in the Browser (AiTB) Likelihood: High · Severity: Very High
The attack patterns MITRE's CAPEC relates to CWE-300, as MITRE names them. Credits.
Ask an AI about CWE-300
Show the prompt
Explain CWE-300: Channel Accessible by Non-Endpoint and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/300.html and https://cve.bz/cve/cwe/300?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.9CVE-2016-10536EPSS 1.0%
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnau…
- 5.9CVE-2017-12697EPSS 1.4%
A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects t…
- 7.4CVE-2017-15086EPSS 1.7%
It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6.
- 5.9CVE-2017-15085EPSS 1.7%
It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6.
- 7.4CVE-2017-12735EPSS 1.1%
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffi…
- 7.4CVE-2017-9941EPSS 0.9%
A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker in a Man-in-the-Middle position between the SiPass integrated server and SiPass integrated clients to read or modify the n…
- 7.4CVE-2017-6870EPSS 0.9%
A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2). The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing …
- 9.8CVE-2017-7480EPSS 2.4%
rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.
- 3.7CVE-2017-6052EPSS 0.6%
A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified e…
- 9.8CVE-2009-3555ExploitEPSS 87%
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla N…