Communication Channel Errors

Opis

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

Wpisy w tej grupie

• CWE-322 Key Exchange without Entity Authentication
• CWE-346 Origin Validation Error
• CWE-385 Covert Timing Channel
• CWE-419 Unprotected Primary Channel
• CWE-420 Unprotected Alternate Channel
• CWE-425 Direct Request ('Forced Browsing')
• CWE-515 Covert Storage Channel
• CWE-918 Server-Side Request Forgery (SSRF)
• CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
• CWE-940 Improper Verification of Source of a Communication Channel
• CWE-941 Incorrectly Specified Destination in a Communication Channel
• CWE-1327 Binding to an Unrestricted IP Address

Uwagi

Most of these issues are probably under-studied. Only a handful of public reports exist.