logo

CWE-784 - Reliance on Cookies without Validation and Integrity Checking in a Security Decision

CWE-784 High

  • Abstraction:
  • Variant
  • Structure:
  • Simple
  • Status:
  • Draft
Weakness Name

Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Description

The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.

Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Attackers can bypass protection mechanisms such as authorization and authentication by modifying the cookie to contain an expected value.

Common Consequences

Scope: Access Control

Impact: Bypass Protection Mechanism, Gain Privileges or Assume Identity

Notes: It is dangerous to use cookies to set a user's privileges. The cookie can be manipulated to claim a high level of authorization, or to claim that successful authentication has occurred.

Related Weaknesses
  • Release Date:
  • 2009-07-27
  • Latest Modification Date:
  • 2023-06-29

Free security scan for your website