CWE-471
Modification of Assumed-Immutable Data (MAID)
AI Translation Available
The product does not properly protect an assumed-immutable element from being modified by an attacker.
Status
draft
Abstraction
base
Affected Platforms
Not Technology-Specific
Web Based
Extended Description
AI Translation
This occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.
Technical Details
AI Translation
Common Consequences
integrity
Impacts
modify application data
unexpected state
Potential Mitigations
Phases:
architecture and design
operation
implementation
Descriptions:
•
When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.