Modification of Assumed-Immutable Data (MAID)
CWE-471
The product does not properly protect an assumed-immutable element from being modified by an attacker.
We track 8 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
How this weakness is prevented
- Architecture and Design Operation Implementation: When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.
Latest Modification of Assumed-Immutable Data (MAID) vulnerabilities
- 7.1 High severity
nautobot: Modification of Assumed-Immutable Data (MAID)
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be
- 8.8 High severity
Aspera Faspex: Modification of Assumed-Immutable Data (MAID)
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper protection of assumed immutable data.
- 7.3 High severity
ANC: Modification of Assumed-Immutable Data (MAID)
: Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.
- 8.3 High severity
JDBC driver: Modification of Assumed-Immutable Data (MAID)
An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further
- 7.3 High severity
SAFE: Modification of Assumed-Immutable Data (MAID)
The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request gen
- 9.8 Critical severity
vm2: Modification of Assumed-Immutable Data (MAID)
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
- 8.4 High severity
Play Services SDK: Modification of Assumed-Immutable Data (MAID)
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected,
- 8.2 High severity
Node: Improperly Controlled Modification of Object Prototype Attributes
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could b