CWE · MITRE source
CWE-346Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 23 mapping(s) from 4 framework(s): CAPEC 12 (partial) · ATT&CK 7 (full) · STIG oracle linux 8 3 (mostly) · OWASP-Web 1 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A07:2025 Authentication Failures.
NIST 800-53 r5 controls that address this weakness (5)AI
Showing the 4 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-11 | Trusted Path | SC | Trusted path establishment enforces validation that the communication originates from and reaches only the intended trusted system components. |
SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | SC | Enforces validation of the true origin of DNS responses via signatures and chain-of-trust mechanisms. |
SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | SC | Enforces origin validation of name/address data, eliminating reliance on unverified or impersonated DNS sources. |
IA-9 | Service Identification and Authentication | IA | Requires unique identification of the service before communications, addressing failures to validate the origin of the interaction. |
Show 1 more broadly-applicable controls
SC-23 | Session Authenticity | SC | Mandates origin validation so that only legitimate endpoints can continue the authenticated session. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2015-4495 KEV | 10.0 | 8.8 | 0.7023 | 2015-08-08 |
CVE-2025-34291 KEV | 10.0 | 8.8 | 0.7889 | 2025-12-05 |
CVE-2009-1185 | 8.0 | 0.0 | 0.8153 | 2009-04-17 |
CVE-2020-16952 | 8.0 | 8.6 | 0.7089 | 2020-10-16 |
CVE-2023-29711 | 8.0 | 9.8 | 0.7031 | 2023-06-22 |
CVE-2024-23898 UPD | 8.0 | 8.8 | 0.6692 | 2024-01-24 |
CVE-2000-1218 | 7.0 | 9.8 | 0.0609 | 2000-04-14 |
CVE-2003-0174 | 7.0 | 9.8 | 0.0098 | 2003-05-12 |
CVE-2017-6519 | 7.0 | 9.1 | 0.0308 | 2017-05-01 |
CVE-2017-13274 | 7.0 | 9.8 | 0.0054 | 2018-04-04 |
CVE-2018-5116 | 7.0 | 9.8 | 0.0112 | 2018-06-11 |
CVE-2018-5400 | 7.0 | 9.1 | 0.0074 | 2018-10-08 |
CVE-2018-15723 | 7.0 | 9.8 | 0.0370 | 2018-12-20 |
CVE-2018-5409 | 7.0 | 9.8 | 0.0108 | 2019-05-08 |
CVE-2019-8069 | 7.0 | 9.8 | 0.0453 | 2019-09-12 |
CVE-2019-3980 | 7.0 | 9.8 | 0.0518 | 2019-10-08 |
CVE-2019-15020 | 7.0 | 9.8 | 0.0089 | 2019-10-09 |
CVE-2019-16517 | 7.0 | 9.8 | 0.0133 | 2020-01-23 |
CVE-2019-4640 | 7.0 | 9.8 | 0.0052 | 2020-02-19 |
CVE-2020-26527 | 7.0 | 9.8 | 0.0091 | 2020-10-02 |
CVE-2021-26291 | 7.0 | 9.1 | 0.0869 | 2021-04-23 |
CVE-2021-37705 | 7.0 | 10.0 | 0.0242 | 2021-08-13 |
CVE-2021-39185 | 7.0 | 9.1 | 0.0059 | 2021-09-01 |
CVE-2021-39063 | 7.0 | 9.1 | 0.0066 | 2021-12-13 |
CVE-2021-44935 | 7.0 | 9.1 | 0.0052 | 2021-12-14 |