| 名称 |
Content Spoofing |
|
| 攻击可能性 |
典型严重性 |
| Medium |
Medium |
|
| 摘要 |
An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes. |
| 前置条件 |
The target must provide content but fail to adequately protect it against modification.The adversary must have the means to alter data to which they are not authorized. If the content is to be modified in transit, the adversary must be able to intercept the targeted messages. |
| 解决方案 | |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-345 |
Insufficient Verification of Data Authenticity |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1491 |
Defacement |
|
| 分类体系：WASC |
|
条目编号
|
条目名称
|
| 12 |
Content Spoofing |
|
| 分类体系：OWASP Attacks |
|
条目编号
|
条目名称
|
| Link |
Content Spoofing |
|