Detailedseverity: MediumDraft
CAPEC-388Application API Button Hijacking
Abstraction
Detailed
Status
Draft
Severity
Medium
Description
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
Related weaknesses· 5
Related attack patterns· 1
Exploits5
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Modification of Assumed-Immutable Data (MAID)cwe-471 | 100% | live |
| Weakness | Missing Encryption of Sensitive Datacwe-311 | 100% | live |
| Weakness | Client-Side Enforcement of Server-Side Securitycwe-602 | 100% | live |
| Weakness | Insufficient Verification of Data Authenticitycwe-345 | 100% | live |
| Weakness | Origin Validation Errorcwe-346 | 100% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.