Home/CWE/Insufficient Verification of Data Authenticity
Weakness

Insufficient Verification of Data Authenticity

CWE-345 · Class · Draft

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-693 · Protection Mechanism Failure
Children (more specific)
ParentOfCWE-1293 · Missing Source Correlation of Multiple Independent Data
ParentOfCWE-346 · Origin Validation Error
ParentOfCWE-347 · Improper Verification of Cryptographic Signature
ParentOfCWE-348 · Use of Less Trusted Source
ParentOfCWE-349 · Acceptance of Extraneous Untrusted Data With Trusted Data
ParentOfCWE-351 · Insufficient Type Distinction
ParentOfCWE-352 · Cross-Site Request Forgery (CSRF)
ParentOfCWE-353 · Missing Support for Integrity Check
ParentOfCWE-354 · Improper Validation of Integrity Check Value
ParentOfCWE-360 · Trust of System Event Data
ParentOfCWE-494 · Download of Code Without Integrity Check
ParentOfCWE-616 · Incomplete Identification of Uploaded File Variables (PHP)
ParentOfCWE-646 · Reliance on File Name or Extension of Externally-Supplied File
ParentOfCWE-649 · Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
ParentOfCWE-924 · Improper Enforcement of Message Integrity During Transmission in a Communication Channel
◆

Attack Patterns (CAPEC)

12
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-111JSON Hijacking (aka JavaScript Hijacking)
CAPEC-141Cache Poisoning
CAPEC-142DNS Cache Poisoning
CAPEC-148Content Spoofing
CAPEC-218Spoofing of UDDI/ebXML Messages
CAPEC-384Application API Message Manipulation via Man-in-the-Middle
CAPEC-385Transaction or Event Tampering via Application API Manipulation
CAPEC-386Application API Navigation Remapping
CAPEC-387Navigation Remapping To Propagate Malicious Content
CAPEC-388Application API Button Hijacking
CAPEC-665Exploitation of Thunderbolt Protection Flaws
CAPEC-701Browser in the Middle (BiTM)
⚠

CVEs With This Weakness

654
A sample of the 654 CVEs tagged with this weakness.
CVECVE-2026-7689
CVECVE-2026-7611
CVECVE-2026-7606
CVECVE-2026-6986
CVECVE-2026-6967
CVECVE-2026-6498
CVECVE-2026-4984
CVECVE-2026-4541
CVECVE-2026-45055
CVECVE-2026-44999
CVECVE-2026-4478
CVECVE-2026-44592
◉

Nuclei Scanner Templates

1
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
mediumMotors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin