BaseDraft

CWE-419Unprotected Primary Channel

Category: other

Description

The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

Common consequences· 1

  • Access Control — Gain Privileges or Assume Identity, Bypass Protection Mechanism

Potential mitigations· 2

  • [Architecture and Design]Do not expose administrative functionnality on the user UI.
  • [Architecture and Design]Protect the administrative/restricted functionality with a strong authentication mechanism.

Related CAPEC attack patterns· 1

CAPEC-383

References

  1. https://cwe.mitre.org/data/definitions/419.html

Exploits (incoming)1

TypeTargetConfidenceTier
AttackPatternHarvesting Information via API Event Monitoringcapec-383100%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CWE
Insufficiently Protected Credentials
CWE
Improper Access Control
CWE
Weak Authentication
CWE
Improper Restriction of Communication Channel to Intended Endpoints
CWE
Exposure of Sensitive Information to an Unauthorized Actor
CWE
Improper Protection of Alternate Path
Sourced from MITRE CWE 4.20. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.