Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CAPEC-51:Poison Web Service Registry
Attack Pattern ID:51
Version:v3.9
Attack Pattern Name:Poison Web Service Registry
Abstraction:Detailed
Status:Draft
Likelihood of Attack:High
Typical Severity:Very High
DetailsContent HistoryRelated WeaknessesReports
3Weaknesses found
CWE-285
Improper Authorization
ShareView Details
Improper Authorization
Likelihood of Exploit-High
Mapping-Discouraged
Abstraction-Class
Found in830CVEs

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Impacts-
Read Application DataRead Files or DirectoriesModify Application DataModify Files or DirectoriesGain Privileges or Assume Identity
Tags-
Web ServerDatabase ServerHigh exploitLibraries or FrameworksModify Application Data (impact)Read Files or Directories (impact)Modify Files or Directories (impact)Read Application Data (impact)Gain Privileges or Assume Identity (impact)
As Seen In-
Not Available
CWE-693
Protection Mechanism Failure
ShareView Details
Protection Mechanism Failure
Likelihood of Exploit-Not Available
Mapping-Discouraged
Abstraction-Pillar
Found in300CVEs

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Impacts-
Bypass Protection Mechanism
Tags-
ICS/OT (technology class)Bypass Protection Mechanism (impact)
As Seen In-
Research Concepts
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
ShareView Details
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Likelihood of Exploit-High
Mapping-Discouraged
Abstraction-Class
Found in2918CVEs

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Impacts-
Read Application DataAlter Execution LogicBypass Protection MechanismHide ActivitiesOther
Tags-
High exploitOther (impact)Bypass Protection Mechanism (impact)Hide Activities (impact)Read Application Data (impact)Alter Execution Logic (impact)
As Seen In-
Simplified Mapping of Published Vulnerabilities