1. Home
  2. Weaknesses
  3. CWE-565

CWE-565: Reliance on Cookies without Validation and Integrity Checking

ID CWE-565
Abstraction Base
Structure Simple
Status Incomplete
Number of CVEs 49
Detail CAPEC Dashboard Vulnerabilities Web & Social
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Reliance on cookies without detailed validation and integrity checking can allow attackers to bypass authentication, conduct injection attacks such as SQL injection and cross-site scripting, or otherwise modify inputs in unexpected ways.

Modes of Introduction

Phase Note
Architecture and Design OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation

Relationships

View Weakness
# ID View Status # ID Name Abstraction Structure Status
CWE-1000 Research Concepts Draft CWE-642 External Control of Critical State Data Class Simple Draft
CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities Incomplete CWE-669 Incorrect Resource Transfer Between Spheres Class Simple Draft
CWE-1000 Research Concepts Draft CWE-602 Client-Side Enforcement of Server-Side Security Class Simple Draft

Common Attack Pattern Enumeration and Classification (CAPEC)

The Common Attack Pattern Enumeration and Classification (CAPEC™) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.

CAPEC at Mitre.org
# ID Name Weaknesses
CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies CWE-565
CAPEC-39 Manipulating Opaque Client-based Data Tokens CWE-565
CAPEC-226 Session Credential Falsification through Manipulation CWE-565

CVEs Published

Based on CVE published date

CVSS Severity

CVSS Severity - By Year

CVSS Base Score

# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date