cve.bz

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data, page 2

Filter

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

What the weakness is: CWE-349 at MITRE

Related attack patterns (CAPEC): 3
  • CAPEC-75 Manipulating Writeable Configuration Files Likelihood: High · Severity: Very High
  • CAPEC-141 Cache Poisoning Likelihood: High · Severity: High
  • CAPEC-142 DNS Cache Poisoning Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-349, as MITRE names them. Credits.

Ask an AI about CWE-349

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/349.html and https://cve.bz/cve/cwe/349?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2020-10751EPSS 0.3%

    A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink mess…

  2. 9.8CVE-2019-9535EPSS 2.5%

    A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including…

  3. 8.8CVE-2018-1131EPSS 1.2%

    Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept cert…