CWE-565—Reliance on Cookies without Validation and Integrity Checking
PUBLISHEDweakness record
released 2006-07-19 · last modified 2025-12-11
Metadata
- CWE ID：
- CWE-565
- 摘要：
- Base
- 结构：
- Simple
- 状态：
- Incomplete
- 发布日期：
- 2006-07-19
- 更新日期：
- 2025-12-11
名称
Reliance on Cookies without Validation and Integrity Checking
描述
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
常见后果
- 范围：
- Confidentiality, Integrity, Availability
- 影响：
- Modify Application Data, Execute Unauthorized Code or Commands
- 注释：
- Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Reliance on cookies without detailed validation and integrity checking can allow attackers to bypass authentication, conduct injection attacks such as SQL injection and cross-site scripting, or otherwise modify inputs in unexpected ways.
- 范围：
- Access Control
- 影响：
- Gain Privileges or Assume Identity
- 注释：
- It is dangerous to use cookies to set a user's privileges. The cookie can be manipulated to escalate an attacker's privileges to an administrative level.
