The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
In order to establish secure communication between two parties, it is often important to adequately verify the identity of entities at each end of the communication channel. Inadequate or inconsistent verification may result in insufficient or incorrect identification of either communicating entity. This can have negative consequences such as misplaced trust in the entity at the other end of the channel. An attacker can leverage this by interposing between the communicating entities and masquerading as the original entity. In the absence of sufficient verification of identity, such an attacker can eavesdrop and potentially modify the communication between the original entities.

Primary

Resultant

Adversary-in-the-Middle / AITM

Attacker-in-the-Middle / AITM

Man-in-the-Middle / MITM

Person-in-the-Middle / PITM

Monkey-in-the-Middle

Monster-in-the-Middle

Manipulator-in-the-Middle

On-path attack

Interception attack

Architecture and Design
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Confidentiality
Integrity
Access Control
Read Application Data
Modify Application Data
Gain Privileges or Assume Identity
An attacker could pose as one of the entities and read or possibly modify the communication.

Automated Dynamic Analysis
Some tools can act as proxy servers that allow the tester to intercept packets or messages, inspect them, and modify them before sending them to the destination in order to see if the modified packets are still accepted by the receiving component.

Automated Dynamic Analysis
Dynamic Application Security Testing (DAST) tools can be used to detect network traffic without encryption and/or verification. The affected protocol may be subject to Adversary-in-the-Middle attacks. Some tools act as proxy servers that allow the tester to inspect and modify packets/messages to see if they are still accepted by the receiving component.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) The analysis could identify use of protocols that are subject to Adversary-in-the-Middle attacks.
Moderate
Encryption and other protection mechanisms may be provided in the environment (e.g., by a load balancer or firewall that is positioned in front of a server), but this cannot be detected by SAST tools.

Implementation
Always fully authenticate both ends of any communications channel.

Architecture and Design
Adhere to the principle of complete mediation.

Implementation
A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.

In the Java snippet below, data is sent over an unencrypted channel to a remote server.

Socket sock;PrintWriter out;
try {
sock = new Socket(REMOTE_HOST, REMOTE_PORT);out = new PrintWriter(echoSocket.getOutputStream(), true);

// Write data to remote host via socket output stream.
...
}

By eavesdropping on the communication channel or posing as the endpoint, an attacker would be able to read all of the transmitted data.

CVE-2014-1266
Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.
https://www.cve.org/CVERecord?id=CVE-2014-1266

Man-in-the-middle (MITM)

32
Routing Detour

SEC06-J
Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar

Discouraged
CWE-300 is commonly misused for vulnerabilities in which the prerequisites for exploitation require the adversary to be in a privileged "in-the-middle" position.
Consider root-cause weaknesses that allow adversary-in-the-middle attacks to happen, such as CWEs involving poor integrity protection.

The summary identifies multiple distinct possibilities, suggesting that this is a category that must be broken into more specific weaknesses.

PLOVER
2006-07-19
Draft 3
2006-07-19

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Maintenance_Notes, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Name

CWE Content Team
MITRE
2010-02-16
updated Taxonomy_Mappings

CWE Content Team
MITRE
2010-12-13
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, Related_Attack_Patterns, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-02-18
updated Relationships

CWE Content Team
MITRE
2014-06-23
updated Observed_Examples

CWE Content Team
MITRE
2014-07-30
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-01-03
updated Taxonomy_Mappings

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Alternate_Terms, Name, Observed_Examples, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Alternate_Terms, Related_Attack_Patterns

CWE Content Team
MITRE
2021-07-20
updated Alternate_Terms, Observed_Examples

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-07-16
4.15
2024-07-16
updated Alternate_Terms

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Alternate_Terms, Detection_Factors

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Observed_Examples, Relationships, Weakness_Ordinalities

Renaud Sauvain
West Pharmaceutical Services
2024-09-02
4.18
2025-09-09

Man-in-the-middle (MITM)
Channel Accessible by Non-Endpoint (aka 'Man-in-the-Middle')
Channel Accessible by Non-Endpoint ('Man-in-the-Middle')