auren-research/cyber-sec huggingface dataset:
This attack pattern has been deprecated as it referes to an existing chain relationship between "CAPEC-93 : Log Injection-Tampering-Forging" and "CAPEC-63 : Cross-Site Scripting". Please refer to these CAPECs going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Architectural_Paradigms, Attack_Motivation-Consequences, Attack_Phases, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, CIA_Impact, Description, Description Summary, Examples-Instances, Frameworks, Injection_Vector, Languages, Methods_of_Attack, Payload, Payload_Activation_Impact, Platforms, Probing_Techniques, Purposes, Related_Attack_Patterns, Related_Security_Principles, Related_Weaknesses, Relevant_Security_Requirements, Resources_Required, Solutions_and_Mitigations, Technical_Context, Typical_Likelihood_of_Exploit, Typical_Severity

Cross Site Scripting through Log Files
An adversary manipulates the use or processing of an interface (e.g. Application Programming Interface (API) or System-on-Chip (SoC)) resulting in an adverse impact upon the security of the system implementing the interface. This can allow the adversary to bypass access control and/or execute functionality not intended by the interface implementation, possibly compromising the system which integrates the interface. Interface manipulation can take on a number of forms including forcing the unexpected use of an interface or the use of an interface in an unintended way.
Medium
Medium

The target system must expose interface functionality in a manner that can be discovered and manipulated by an adversary. This may require reverse engineering the interface or decrypting/de-obfuscating client-server exchanges.

The requirements vary depending upon the nature of the interface. For example, application-layer APIs related to the processing of the HTTP protocol may require one or more of the following: an Adversary-In-The-Middle (CAPEC-94) proxy, a web browser, or a programming/scripting language.

An adversary may make a request to an application that leverages a non-standard API that is known to incorrectly validate its data and thus it may be manipulated by supplying metacharacters or alternate encodings as input, resulting in any number of injection flaws, including SQL injection, cross-site scripting, or command execution.
API methods not intended for production, such as debugging or testing APIs, may not be disabled when deploying in a production environment. As a result, dangerous functionality can be exposed within the production environment, which an adversary can leverage to execute additional attacks.
SoC components contain insufficient identifiers, which allows an adversary to reset the device at will or read sensitive data from the device.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Attack_Prerequisites, Description Summary, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Injection_Vector, Payload, Payload_Activation_Impact, Related_Weaknesses, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated @Name, @Status, Description, Example_Instances, Prerequisites, Related_Weaknesses, Resources_Required

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses, Resources_Required

API Abuse/Misuse
API Manipulation
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.

This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.

Medium

An authentication mechanism or subsystem implementing some form of authentication such as passwords, digest authentication, security certificates, etc. which is flawed in some way.

A client application, command-line access to a binary, or scripting language capable of interacting with the authentication mechanism.

1548
Abuse Elevation Control Mechanism

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.

This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to get to secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.

Medium

An authentication mechanism or subsystem implementing some form of authentication such as passwords, digest authentication, security certificates, etc.

A client application, such as a web browser, or a scripting language capable of interacting with the target.

1548
Abuse Elevation Control Mechanism

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.

This is achieved by exploring the target via ordinary interactions for the purpose of gathering intelligence about the target, or by sending data that is syntactically invalid or non-standard in an attempt to produce a response that contains the desired data. As a result of these interactions, the adversary is able to obtain information from the target that aids the attacker in making inferences about its security, configuration, or potential vulnerabilities. Examplar exchanges with the target may trigger unhandled exceptions or verbose error messages that reveal information like stack traces, configuration information, path information, or database design. This type of attack also includes the manipulation of query strings in a URI to produce invalid SQL queries, or by trying alternative path values in the hope that the server will return useful information.

High
Medium

An adversary requires some way of interacting with the system.

A tool, such as an Adversary in the Middle (CAPEC-94) Proxy or a fuzzer, that is capable of generating and injecting custom inputs to be used in the attack.

Confidentiality
Read Data

Minimize error/response output to only what is necessary for functional use or corrective language.
Remove potentially sensitive information that is not necessary for the application's functionality.

Large quantities of data is often moved from the target system to some other adversary controlled system. Data found on a target system might require extensive resources to be fully analyzed. Using these resources on the target system might enable a defender to detect the adversary. Additionally, proper analysis tools required might not be available on the target system.
This attack differs from Data Interception and other data collection attacks in that the attacker actively queries the target rather than simply watching for the target to reveal information.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Activation_Zone, Attack_Prerequisites, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Other_Notes, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Description, Extended_Description
An adversary monitors data streams to or from the target for information gathering purposes. This attack may be undertaken to solely gather sensitive information or to support a further attack against the target. This attack pattern can involve sniffing network traffic as well as other types of data streams (e.g. radio). The adversary can attempt to initiate the establishment of a data stream or passively observe the communications as they unfold. In all variants of this attack, the adversary is not the intended recipient of the data stream. In contrast to other means of gathering information (e.g., targeting data leaks), the adversary must actively position themself so as to observe explicit data channels (e.g. network traffic) and read the content. However, this attack differs from a Adversary-In-the-Middle (CAPEC-94) attack, as the adversary does not alter the content of the communications nor forward data to the intended recipient.
Low
Medium

The target must transmit data over a medium that is accessible to the adversary.

The adversary must have the necessary technology to intercept information passing between the nodes of a network. For TCP/IP, the capability to run tcpdump, ethereal, etc. can be useful. Depending upon the data being targeted the technological requirements will change.

Confidentiality
Read Data

Leverage encryption to encode the transmission of data thus making it accessible only to authorized parties.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Related_Weaknesses, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Prerequisites, Description Summary, Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Description, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Description
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.
This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.

High
Medium

The target must have misconfigured their access control mechanisms such that sensitive information, which should only be accessible to more trusted users, remains accessible to less trusted users.
The adversary must have access to the target, albeit with an account that is less privileged than would be appropriate for the targeted resources.

Adversary can leverage privileged features they already have access to without additional effort or skill. Adversary is only required to have access to an account with improper priveleges.

None: No specialized resources are required to execute this type of attack. The ability to access the target is required.

Integrity
Modify Data

Confidentiality
Read Data

Authorization
Execute Unauthorized Commands
Run Arbitrary Code

Authorization
Gain Privileges

Access Control
Authorization
Bypass Protection Mechanism

Configure account privileges such privileged/administrator functionality is not exposed to non-privileged/lower accounts.

Improperly configured account privileges allowed unauthorized users on a hospital's network to access the medical records for over 3,000 patients. Thus compromising data integrity and confidentiality in addition to HIPAA violations.

1548
Abuse Elevation Control Mechanism

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Consequences, Example_Instances, Likelihood_Of_Attack, Mitigations, Skills_Required

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description, Skills_Required

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary manipulates an application's interaction with a buffer in an attempt to read or modify data they shouldn't have access to. Buffer attacks are distinguished in that it is the buffer space itself that is the target of the attack rather than any code responsible for interpreting the content of the buffer. In virtually all buffer attacks the content that is placed in the buffer is immaterial. Instead, most buffer attacks involve retrieving or providing more input than can be stored in the allocated buffer, resulting in the reading or overwriting of other unintended program memory.
High
Very High

The adversary must identify a programmatic means for interacting with a buffer, such as vulnerable C code, and be able to provide input to this interaction.

Availability
Unreliable Execution
A buffer manipulation attack often results in a crash of the application due to the corruption of memory.

Confidentiality
Execute Unauthorized Commands
Modify Data
Read Data
If constructed properly, a buffer manipulation attack can be used to contol the execution of the application leading to any number of negative consequenses.

To help protect an application from buffer manipulation attacks, a number of potential mitigations can be leveraged. Before starting the development of the application, consider using a code language (e.g., Java) or compiler that limits the ability of developers to act beyond the bounds of a buffer. If the chosen language is susceptible to buffer related issues (e.g., C) then consider using secure functions instead of those vulnerable to buffer manipulations. If a potentially dangerous function must be used, make sure that proper boundary checking is performed. Additionally, there are often a number of compiler-based mechanisms (e.g., StackGuard, ProPolice and the Microsoft Visual Studio /GS flag) that can help identify and protect against potential buffer issues. Finally, there may be operating system level preventative functionality that can be applied.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Activation_Zone, Attack_Motivation-Consequences, Injection_Vector, Payload, Payload_Activation_Impact, Related_Attack_Patterns, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
An adversary exploits a resource shared between multiple applications, an application pool or hardware pin multiplexing to affect behavior. Resources may be shared between multiple applications or between multiple threads of a single application. Resource sharing is usually accomplished through mutual access to a single memory location or multiplexed hardware pins. If an adversary can manipulate this shared resource (usually by co-opting one of the applications or threads) the other applications or threads using the shared resource will often continue to trust the validity of the compromised shared resource and use it in their calculations. This can result in invalid trust assumptions, corruption of additional data through the normal operations of the other users of the shared resource, or even cause a crash or compromise of the sharing applications.
Medium

The target applications, threads or functions must share resources between themselves.
The adversary must be able to manipulate some piece of the shared resource either directly or indirectly and the other users of the data must accept the changed data as valid. Usually this requires that the adversary be able to compromise one of the sharing applications or threads in order to manipulate the shared data.

None: The attacker does not need any specialized resources to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Description Summary, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Prerequisites, Description Summary, Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated @Name, Description, Prerequisites, Related_Weaknesses, Resources_Required

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Weaknesses

Attack through Shared Data
Shared Data Manipulation
An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
High
Medium

Any target that services requests is vulnerable to this attack on some level of scale.

A script or program capable of generating more requests than the target can handle, or a network or cluster of objects all capable of making simultaneous requests.

Availability
Unreliable Execution
Resource Consumption
A successful flooding attack compromises the availability of the target system's service by exhausting its available resources.

Ensure that protocols have specific limits of scale configured.
Specify expectations for capabilities and dictate which behaviors are acceptable when resource allocation reaches limits.
Uniformly throttle all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

1498.001
Network Denial of Service: Direct Network Flood

1499
Endpoint Denial of Service

10
Denial of Service

Traffic flood

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Attack_Motivation-Consequences, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An attacker takes advantage of the structure of integer variables to cause these variables to assume values that are not expected by an application. For example, adding one to the largest positive integer in a signed integer variable results in a negative number. Negative numbers may be illegal in an application and the application may prevent an attacker from providing them directly, but the application may not consider that adding two positive numbers can create a negative number do to the structure of integer storage formats.
Medium

The target application must have an integer variable for which only some of the possible integer values are expected by the application and where there are no checks on the value of the variable before use.
The attacker must be able to manipulate the targeted integer variable such that normal operations result in non-standard values due to the storage structure of integers.

None: No specialized resources are required to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required
This attack pattern involves an adversary manipulating a pointer within a target application resulting in the application accessing an unintended memory location. This can result in the crashing of the application or, for certain pointer values, access to data that would not normally be possible or the execution of arbitrary code. Since pointers are simply integer variables, Integer Attacks may often be used in Pointer Attacks.
Medium

The target application must have a pointer variable that the attacker can influence to hold an arbitrary value.

None: No specialized resources are required to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Description Summary, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

Pointer Attack