CAPEC 445 Malicious Logic Insertion into Product Software via Configuration Management Manipulation

Stable Detailed Medium Risk
Severity High

Description

{'xhtml:p': 'An adversary exploits a configuration management system so that malicious logic is inserted into a software products build, update or deployed environment. If an adversary can control the elements included in a product's configuration management for build they can potentially replace, modify or insert code files containing malicious logic. If an adversary can control elements of a product's ongoing operational configuration management baseline they can potentially force clients receiving updates from the system to install insecure software when receiving updates from the server.'}

Mitigations

2

Consequences

Relationships

Related ATT&CK Techniques

1