cve.bz

CWE-348: Use of Less Trusted Source, page 3

Filter

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

What the weakness is: CWE-348 at MITRE

Related attack patterns (CAPEC): 5
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-141 Cache Poisoning Likelihood: High · Severity: High
  • CAPEC-142 DNS Cache Poisoning Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-348, as MITRE names them. Credits.

Ask an AI about CWE-348

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-348: Use of Less Trusted Source and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/348.html and https://cve.bz/cve/cwe/348?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2021-21374EPSS 1.0%

    Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due …

  2. 5.9CVE-2021-21373EPSS 1.2%

    Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS U…