Detailedlikelihood: Mediumseverity: HighDraft
CAPEC-14Client-side Injection-induced Buffer Overflow
Abstraction
Detailed
Status
Draft
Likelihood
Medium
Severity
High
Description
This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service. This hostile service is created to deliver the correct content to the client software. For example, if the client-side application is a browser, the service will host a webpage that the browser loads.
Related weaknesses· 8
Related attack patterns· 1
Exploits8
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Restriction of Operations within the Bounds of a Memory Buffercwe-119 | 100% | live |
| Weakness | Missing Support for Integrity Checkcwe-353 | 100% | live |
| Weakness | Incorrect Access of Indexable Resource ('Range Error')cwe-118 | 100% | live |
| Weakness | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')cwe-74 | 100% | live |
| Weakness | Integer Overflow to Buffer Overflowcwe-680 | 100% | live |
| Weakness | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')cwe-120 | 100% | live |
| Weakness | Incorrect Comparisoncwe-697 | 100% | live |
| Weakness | Improper Input Validationcwe-20 | 100% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.