CWE-565 - Reliance on Cookies without Validation and Integrity Checking
CWE-565
- Abstraction:
- Base
- Structure:
- Simple
- Status:
- Incomplete
- Weakness Name
Reliance on Cookies without Validation and Integrity Checking
- Description
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Reliance on cookies without detailed validation and integrity checking can allow attackers to bypass authentication, conduct injection attacks such as SQL injection and cross-site scripting, or otherwise modify inputs in unexpected ways.
- Common Consequences
Scope: Access Control
Impact: Gain Privileges or Assume Identity
Notes: It is dangerous to use cookies to set a user's privileges. The cookie can be manipulated to escalate an attacker's privileges to an administrative level.
- Related Weaknesses
- Related Alerts
- Release Date:
- 2006-07-19
- Latest Modification Date:
- 2023-10-26
Free security scan for your website