CAPEC-81: Web Server Logs Tampering

ID CAPEC-81
Typical Severity High
Likelihood Of Attack Medium
Status Draft

Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.

https://capec.mitre.org/data/definitions/81.html

Weaknesses

# ID Name Type
CWE-20 Improper Input Validation weakness
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) weakness
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') weakness
CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') weakness
CWE-116 Improper Encoding or Escaping of Output weakness
CWE-117 Improper Output Neutralization for Logs weakness
CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness
CWE-221 Information Loss or Omission weakness
CWE-276 Incorrect Default Permissions weakness
CWE-279 Incorrect Execution-Assigned Permissions weakness
Loading...