CWEweakness

CWE-348 Use of Less Trusted Source

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Common consequences

• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity — An attacker could utilize the untrusted data source to bypass protection mechanisms and gain access to sensitive data.

Observed examples

• CVE-2001-0860: Product uses IP address provided by a client, instead of obtaining it from the packet headers, allowing easier spoofing. • CVE-2004-1950: Web product uses the IP address in the X-Forwarded-For HTTP header instead of a server variable that uses the connecting IP address, allowing filter bypass. • CVE-2001-0908: Product logs IP address specified by the client instead of obtaining it from the packet headers, allowing information hiding. • CVE-2006-1126: PHP application uses IP address from X-Forwarded-For HTTP header, instead of REMOTE_ADDR.

Related

Attack pattern · CAPEC (5)

  • CAPEC-141 Cache Poisoning attack pattern
  • CAPEC-142 DNS Cache Poisoning attack pattern
  • CAPEC-73 User-Controlled Filename attack pattern
  • CAPEC-76 Manipulating Web Input to File System Calls attack pattern
  • CAPEC-85 AJAX Footprinting attack pattern

Observed example · CVE (4)

  • CVE-2006-1126 Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which… vulnerability
  • CVE-2004-1950 phpBB 2.0.8a and earlier trusts the IP address that is in the X-Forwarded-For in the HTTP header, which allows remote attackers to spoof IP… vulnerability
  • CVE-2001-0860 Terminal Services Manager MMC in Windows 2000 and XP trusts the Client Address (IP address) that is provided by the client instead of… vulnerability
  • CVE-2001-0908 CITRIX Metaframe 1.8 logs the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers,… vulnerability

Child of · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

Referenced by CAPEC · weakness (5)

  • CAPEC-141 Cache Poisoning attack pattern
  • CAPEC-142 DNS Cache Poisoning attack pattern
  • CAPEC-73 User-Controlled Filename attack pattern
  • CAPEC-76 Manipulating Web Input to File System Calls attack pattern
  • CAPEC-85 AJAX Footprinting attack pattern

Referenced by CVE · weakness (99)

  • CVE-2026-118265 Echo is a Go web framework. vulnerability
  • CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that… vulnerability
  • CVE-2026-114437 In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never… vulnerability
  • CVE-2026-114474 Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6… vulnerability
  • CVE-2026-107567 Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated… vulnerability
  • CVE-2026-111934 Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied… vulnerability
  • CVE-2026-111443 Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in… vulnerability
  • CVE-2026-111450 Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. vulnerability
  • CVE-2026-110726 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from… vulnerability
  • CVE-2026-93483 In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system… vulnerability
  • CVE-2026-108736 Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade… vulnerability
  • CVE-2026-108162 Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP… vulnerability
  • CVE-2026-108555 PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery… vulnerability
  • CVE-2026-78015 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. vulnerability
  • CVE-2026-107271 Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by… vulnerability
  • CVE-2026-105051 Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD;… vulnerability
  • CVE-2026-103592 simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote… vulnerability
  • CVE-2026-101277 A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. vulnerability
  • CVE-2026-102630 UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation,… vulnerability
  • CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. vulnerability
  • CVE-2026-100653 vLLM is an inference and serving engine for large language models. vulnerability
  • CVE-2026-80514 The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using… vulnerability
  • CVE-2026-92530 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1… vulnerability
  • CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. vulnerability
  • CVE-2026-84718 A flaw was found in the Ansible Automation Platform automation-controller. vulnerability
  • CVE-2026-87070 The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring… vulnerability
  • CVE-2026-62987 Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. vulnerability
  • CVE-2026-61682 kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. vulnerability
  • CVE-2026-61589 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. vulnerability
  • CVE-2026-92395 @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify… vulnerability
Show all 99 ›

Referenced by CWE · has member (1)