CWE-1293Missing Source Correlation of Multiple Independent Data

Description

Common consequences· 1

• Confidentiality / Integrity — Read Application Data, Modify Application Data, Gain Privileges or Assume Identity
  An attacker that may be able to execute a single Person-in-the-Middle attack can subvert a check of an external oracle (e.g. the ACME protocol check for a file on a website), and thus inject an arbitrary reply to the single perspective request to the external oracle.

Potential mitigations· 2

• [Requirements]Design system to use a Practical Byzantine fault method, to request information from multiple sources to verify the data and report on potentially compromised information sources.
• [Implementation]Failure to use a Practical Byzantine fault method when requesting data. Lack of place to report potentially compromised information sources. Relying on non-independent information sources for integrity checking. Failure to report information sources that respond in the minority to incident response procedures.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.