Common Weakness Enumeration

CWE-360

Weakness Allowed

Trust of System Event Data

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

Security based on event locations are insecure and can be spoofed.

Events are a messaging system that may provide control data to programs listening for events. Events often do not have any type of authentication framework to allow them to be verified from a trusted source. Any application, in Windows, on a given desktop can send a message to any window on the same desktop. There is no authentication framework for these messages. Therefore, any message can be used to manipulate any process on the desktop if the process does not check the validity and safeness of those messages.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members
ChildOf: CWE-345 · View CWE-1000
Modes of introduction
Architecture and Design
Implementation
Content history
Submission: CLASP · 2006-07-19 · CWE Draft 3
Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Time_of_Introduction

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2010-02-16 · CWE 1.8

updated Description, Other_Notes

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Relationships

Modification: CWE Content Team · MITRE · 2012-10-30 · CWE 2.3

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2013-02-21 · CWE 2.4

updated Potential_Mitigations

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Applicable_Platforms

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated References, Relationships

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2023-10-26 · CWE 4.13

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Description, Potential_Mitigations

3 vulnerabilities reference this CWE, most recent first.

CVE-2024-3371 (GCVE-0-2024-3371)

Vulnerability from cvelistv5 – Published: 2024-04-24 16:32 – Updated: 2024-08-07 15:29
VLAI
Title
Insufficient validation of external input in Compass may enable MITM attacks
Summary
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 15:29 UTC
CWE
  • CWE-360 - Trust of System Event Data
Assigner
mongodb CNA under the mitre root
CNA scorecard C 70/100 over 235 records in the last 180 days details
References
Impacted products
Vendor Product Version
MongoDB Inc MongoDB Compass Affected: 1.35.0 , ≤ 1.42.0 (custom)
    cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2024-04-24 16:32
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T15:29:36.154092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:29:49.075Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:12:06.560Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/COMPASS-7260"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "MongoDB Compass",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThanOrEqual": "1.42.0",
              "status": "affected",
              "version": "1.35.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-04-24T16:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-360",
              "description": "CWE-360: Trust of System Event Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-26T14:20:07.672Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/COMPASS-7260"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Insufficient validation of external input in Compass may enable MITM attacks",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2024-3371",
    "datePublished": "2024-04-24T16:32:07.178Z",
    "dateReserved": "2024-04-05T12:44:52.126Z",
    "dateUpdated": "2024-08-07T15:29:49.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-0911 (GCVE-0-2017-0911)

Vulnerability from cvelistv5 – Published: 2018-02-09 22:00 – Updated: 2024-09-17 03:32
VLAI
Summary
Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service.
Severity
No CVSS data available.
CWE
  • CWE-360 - Trust of System Event Data (CWE-360)
Assigner
hackerone CNA under the mitre root
CNA scorecard D 59/100 over 213 records in the last 180 days details
References
Impacted products
Vendor Product Version
Twitter Twitter Kit for iOS Affected: Versions 3.0 to 3.2.1
Create a notification for this product.
Date Public
2017-11-28 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:25:16.966Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/290229"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Twitter Kit for iOS",
          "vendor": "Twitter",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 3.0 to 3.2.1"
            }
          ]
        }
      ],
      "datePublic": "2017-11-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the \"Login with Twitter\" component allowing an attacker to provide alternate credentials. In the final step of \"Login with Twitter\" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-\u003cconsumer-key\u003e) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-360",
              "description": "Trust of System Event Data (CWE-360)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-09T21:57:01.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/290229"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "DATE_PUBLIC": "2017-11-28T00:00:00",
          "ID": "CVE-2017-0911",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Twitter Kit for iOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions 3.0 to 3.2.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Twitter"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the \"Login with Twitter\" component allowing an attacker to provide alternate credentials. In the final step of \"Login with Twitter\" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-\u003cconsumer-key\u003e) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Trust of System Event Data (CWE-360)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/290229",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/290229"
            },
            {
              "name": "https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html",
              "refsource": "CONFIRM",
              "url": "https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html"
            },
            {
              "name": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411",
              "refsource": "CONFIRM",
              "url": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411"
            },
            {
              "name": "https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017",
              "refsource": "CONFIRM",
              "url": "https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017"
            },
            {
              "name": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71",
              "refsource": "CONFIRM",
              "url": "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2017-0911",
    "datePublished": "2018-02-09T22:00:00.000Z",
    "dateReserved": "2016-11-30T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:32:53.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-838G-CPGM-J985

Vulnerability from github – Published: 2024-04-24 18:30 – Updated: 2025-02-06 18:31
VLAI
Details

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.40.5.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-3371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-360"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-24T17:15:47Z",
    "severity": "HIGH"
  },
  "details": "MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.40.5.",
  "id": "GHSA-838g-cpgm-j985",
  "modified": "2025-02-06T18:31:01Z",
  "published": "2024-04-24T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3371"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/COMPASS-7260"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

Never trust or rely on any of the information in an Event for security.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list