CWEweakness

CWE-471 Modification of Assumed-Immutable Data (MAID)

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly protect an assumed-immutable element from being modified by an attacker.

Common consequences

• Integrity: Modify Application Data — Common data types that are attacked are environment variables, web application parameters, and HTTP headers. • Integrity: Unexpected State

Potential mitigations

• [Architecture and Design, Operation, Implementation] When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.

Observed examples

• CVE-2002-1757: Relies on $PHP_SELF variable for authentication. • CVE-2005-1905: Gain privileges by modifying assumed-immutable code addresses that are accessed by a driver.

Related

Attack pattern · CAPEC (5)

  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle attack pattern
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation attack pattern
  • CAPEC-386 Application API Navigation Remapping attack pattern
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content attack pattern
  • CAPEC-388 Application API Button Hijacking attack pattern

Observed example · CVE (2)

  • CVE-2005-1905 The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by… vulnerability
  • CVE-2002-1757 PHProjekt 2.0 through 3.1 relies on the $PHP_SELF variable for authentication, which allows remote attackers to bypass authentication for… vulnerability

Child of · CWE (1)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness

Referenced by CAPEC · weakness (5)

  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle attack pattern
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation attack pattern
  • CAPEC-386 Application API Navigation Remapping attack pattern
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content attack pattern
  • CAPEC-388 Application API Button Hijacking attack pattern

Referenced by CVE · weakness (42)

  • CVE-2026-107296 msgpack5 is a msgpack v5 implementation for node.js and the browser. vulnerability
  • CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards. vulnerability
  • CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts… vulnerability
  • CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding,… vulnerability
  • CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function. vulnerability
  • CVE-2026-50481 Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. vulnerability
  • CVE-2026-54267 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. vulnerability
  • CVE-2026-44798 Nautobot is a Network Source of Truth and Network Automation Platform. vulnerability
  • CVE-2026-8492 Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. vulnerability
  • CVE-2024-57708 An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and… vulnerability
  • CVE-2025-33136 IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on… vulnerability
  • CVE-2024-9876 : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4;… vulnerability
  • CVE-2024-55551 An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). vulnerability
  • CVE-2024-45672 IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow a local privileged user to overwrite files due to excessive privileges granted… vulnerability
  • CVE-2024-51462 IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper… vulnerability
  • CVE-2024-34517 The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin… vulnerability
  • CVE-2023-46232 era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. vulnerability
  • CVE-2023-43697 Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load… vulnerability
  • CVE-2023-2904 The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the… vulnerability
  • CVE-2022-25893 The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set… vulnerability
  • CVE-2022-3288 A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows… vulnerability
  • CVE-2022-2390 Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification… vulnerability
  • CVE-2022-1561 Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing… vulnerability
  • CVE-2022-21824 Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the… vulnerability
  • CVE-2021-24046 A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the… vulnerability
  • CVE-2021-42701 An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the… vulnerability
  • CVE-2021-37177 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). vulnerability
  • CVE-2021-37193 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). vulnerability
  • CVE-2020-26268 In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file… vulnerability
  • CVE-2020-26245 npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. vulnerability
Show all 42 ›

Referenced by CWE · can precede (5)

  • CWE-1282 Assumed-Immutable Data is Stored in Writable Memory weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-425 Direct Request weakness
  • CWE-602 Client-Side Enforcement of Server-Side Security weakness
  • CWE-621 Variable Extraction Error weakness

Referenced by CWE · child of (3)

  • CWE-472 External Control of Assumed-Immutable Web Parameter weakness
  • CWE-473 PHP External Variable Modification weakness
  • CWE-607 Public Static Final Field References Mutable Object weakness

Referenced by OWASP · mapped cwe (1)