CWE-99
Allowed-with-ReviewImproper Control of Resource Identifiers ('Resource Injection')
Abstraction: Class · Status: Draft
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
132 vulnerabilities reference this CWE, most recent first.
GHSA-HQQR-G92G-V6CF
Vulnerability from github – Published: 2022-05-13 01:09 – Updated: 2022-05-13 01:09A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.
{
"affected": [],
"aliases": [
"CVE-2016-8615"
],
"database_specific": {
"cwe_ids": [
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-01T06:29:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.",
"id": "GHSA-hqqr-g92g-v6cf",
"modified": "2022-05-13T01:09:03Z",
"published": "2022-05-13T01:09:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8615"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2486"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3558"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8615"
},
{
"type": "WEB",
"url": "https://curl.haxx.se/CVE-2016-8615.patch"
},
{
"type": "WEB",
"url": "https://curl.haxx.se/docs/adv_20161102A.html"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-47"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2016-21"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94096"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037192"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J327-C69H-4GH8
Vulnerability from github – Published: 2023-05-30 15:30 – Updated: 2023-11-16 21:03A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/pydio/cells/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-2980"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-99"
],
"github_reviewed": true,
"github_reviewed_at": "2023-11-16T21:03:49Z",
"nvd_published_at": "2023-05-30T15:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.",
"id": "GHSA-j327-c69h-4gh8",
"modified": "2023-11-16T21:03:49Z",
"published": "2023-05-30T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2980"
},
{
"type": "PACKAGE",
"url": "https://github.com/pydio/cells"
},
{
"type": "WEB",
"url": "https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be"
},
{
"type": "WEB",
"url": "https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.230212"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.230212"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Abstrium Pydio Cells Resource Injection vulnerability"
}
GHSA-J6RQ-MPPC-H3JR
Vulnerability from github – Published: 2025-01-06 18:31 – Updated: 2025-11-03 21:32A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.
{
"affected": [],
"aliases": [
"CVE-2023-6604"
],
"database_specific": {
"cwe_ids": [
"CWE-94",
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T17:15:14Z",
"severity": "MODERATE"
},
"details": "A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.",
"id": "GHSA-j6rq-mppc-h3jr",
"modified": "2025-11-03T21:32:03Z",
"published": "2025-01-06T18:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6604"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334337"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JPJ7-7JV5-RP9J
Vulnerability from github – Published: 2026-10-14 06:31 – Updated: 2026-10-14 06:31Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
{
"affected": [],
"aliases": [
"CVE-2026-50218"
],
"database_specific": {
"cwe_ids": [
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T06:17:06Z",
"severity": "HIGH"
},
"details": "Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application\u0027s functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.",
"id": "GHSA-jpj7-7jv5-rp9j",
"modified": "2026-10-14T06:31:16Z",
"published": "2026-10-14T06:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50218"
},
{
"type": "WEB",
"url": "https://techdocs.akamai.com/guardicore-platform-agent/changelog"
},
{
"type": "WEB",
"url": "https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JVR7-6JV9-X5C8
Vulnerability from github – Published: 2025-04-22 03:30 – Updated: 2025-04-22 03:30A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php/team_members/save_profile_image/ of the component Profile Picture Handler. The manipulation of the argument profile_image_file leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-3855"
],
"database_specific": {
"cwe_ids": [
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-22T01:15:18Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php/team_members/save_profile_image/ of the component Profile Picture Handler. The manipulation of the argument profile_image_file leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-jvr7-6jv9-x5c8",
"modified": "2025-04-22T03:30:26Z",
"published": "2025-04-22T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3855"
},
{
"type": "WEB",
"url": "https://github.com/L4zyFox/RISE-Ultimate_Project_Manager_e_CRM"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.305780"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.305780"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.556871"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M2P7-7XPW-VF3V
Vulnerability from github – Published: 2025-04-08 06:30 – Updated: 2025-04-08 06:30A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request Handler. The manipulation of the argument ORDER_ID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-3405"
],
"database_specific": {
"cwe_ids": [
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T04:15:31Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request Handler. The manipulation of the argument ORDER_ID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-m2p7-7xpw-vf3v",
"modified": "2025-04-08T06:30:38Z",
"published": "2025-04-08T06:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3405"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1yhZiKFX0avpLDsYDlbnmmkTk4XTY8Y2h/view"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.303649"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.303649"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.544136"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M3F2-GXH3-V237
Vulnerability from github – Published: 2026-06-15 03:30 – Updated: 2026-06-15 03:30A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-12207"
],
"database_specific": {
"cwe_ids": [
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T02:16:12Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\\modules\\medical\\port\\rest\\controllers\\PatientController.php of the component HTTP REST API. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-m3f2-gxh3-v237",
"modified": "2026-06-15T03:30:32Z",
"published": "2026-06-15T03:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12207"
},
{
"type": "WEB",
"url": "https://github.com/onyxglitch/Medkey-EHR-IDOR-PoC"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-12207"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/831893"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/370849"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/370849/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P3RH-58J4-QHHQ
Vulnerability from github – Published: 2025-03-09 18:30 – Updated: 2025-03-09 18:30A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-2125"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-09T16:15:12Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-p3rh-58j4-qhhq",
"modified": "2025-03-09T18:30:52Z",
"published": "2025-03-09T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2125"
},
{
"type": "WEB",
"url": "https://github.com/yago3008/cves"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.299038"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.299038"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.509856"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PFR5-9J62-PW9G
Vulnerability from github – Published: 2025-02-23 06:31 – Updated: 2025-02-23 06:31A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument cod/codexame leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-1575"
],
"database_specific": {
"cwe_ids": [
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-23T04:15:24Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument cod/codexame leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-pfr5-9j62-pw9g",
"modified": "2025-02-23T06:31:12Z",
"published": "2025-02-23T06:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1575"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1zBAwcqfv6-HvDQg6ch3ywbllo0VlLIoQ/view?usp=sharing"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.296550"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.296550"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.497083"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PHM7-HV7V-CQQR
Vulnerability from github – Published: 2022-10-31 19:00 – Updated: 2022-11-01 19:00A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.
{
"affected": [],
"aliases": [
"CVE-2022-3774"
],
"database_specific": {
"cwe_ids": [
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-31T16:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.",
"id": "GHSA-phm7-hv7v-cqqr",
"modified": "2022-11-01T19:00:30Z",
"published": "2022-10-31T19:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3774"
},
{
"type": "WEB",
"url": "https://github.com/rohit0x5/poc/blob/main/idor"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.212504"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/169604/Train-Scheduler-App-1.0-Insecure-Direct-Object-Reference.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, it can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
CAPEC-10: Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
CAPEC-240: Resource Injection
An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.