cve.bz

CWE-472: External Control of Assumed-Immutable Web Parameter, page 4

Filter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

What the weakness is: CWE-472 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 4
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-39 Manipulating Opaque Client-based Data Tokens Likelihood: High · Severity: Medium
  • CAPEC-146 XML Schema Poisoning Likelihood: Low · Severity: High
  • CAPEC-226 Session Credential Falsification through Manipulation Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-472, as MITRE names them. Credits.

Ask an AI about CWE-472

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-472: External Control of Assumed-Immutable Web Parameter and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/472.html and https://cve.bz/cve/cwe/472?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2024-25153EPSS 42%

    A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfu…

  2. 5.9CVE-2023-28512EPSS 0.5%

    IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation. IBM X-Force ID: 250396.

  3. 5.3CVE-2024-22049EPSS 1.3%

    httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker cont…

  4. 5.3CVE-2022-30597EPSS 1.3%

    A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.

  5. 8.8CVE-2021-27770EPSS 0.7%

    The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external UR…

  6. 5.3CVE-2021-27769EPSS 0.8%

    Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any …

  7. 9.8CVE-2021-1295EPSS 4.4%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an af…

  8. 9.8CVE-2021-1294EPSS 4.7%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an af…

  9. 9.8CVE-2021-1293EPSS 5.7%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an af…

  10. 9.8CVE-2021-1292EPSS 4.4%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an af…

  11. 9.8CVE-2021-1291EPSS 4.4%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an af…

  12. 9.8CVE-2021-1290EPSS 4.4%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an af…

  13. 9.8CVE-2021-1289EPSS 4.4%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an af…

  14. 5.3CVE-2020-1765EPSS 1.5%

    An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x…

  15. 5.3CVE-2019-13927EPSS 1.7%

    A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 (All firmware versions < V6.00.320), Desigo PX automation controll…

  16. 8.8CVE-2017-5261ExploitEPSS 8.9%

    In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users.

  17. 8.8CVE-2017-5260ExploitEPSS 8.1%

    In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessibl…