CWE-649

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking

BaseIncompleteLikelihood: High

Description

The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified.

When an application relies on obfuscation or incorrectly applied / weak encryption to protect client-controllable tokens or parameters, that may have an effect on the user state, system state, or some decision made on the server. Without protecting the tokens/parameters for integrity, the application is vulnerable to an attack where an adversary traverses the space of possible values of the said token/parameter in order to attempt to gain an advantage. The goal of the attacker is to find another admissible value that will somehow elevate their privileges in the system, disclose information or change the behavior of the system in some way beneficial to the attacker. If the application does not protect these critical tokens/parameters for integrity, it will not be able to determine that these values have been tampered with. Measures that are used to protect data for confidentiality should not be relied upon to provide the integrity service.

Hierarchy (View 1000)

Parents

CWE-345

Children

none

Related attack patterns (CAPEC)

CAPEC-463

CVEs mapped to this weakness (5)

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2024-10772	—	Hig	0.57	8.8	Dec 6, 2024	Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.
CVE-2025-41351	Funambol Funambol Cloud Server	Med	0.39	—	Jan 28, 2026	Vulnerability that allows a Padding Oracle Attack to be performed on the Funambol v30.0.0.20 cloud server. The thumbnail display URL allows an attacker to decrypt and encrypt the parameters used by the application to generate ‘self-signed’ access URLs.
CVE-2024-36279	FreeFrom FreeFrom	Med	0.34	5.3	Jun 17, 2024	Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may…
CVE-2025-5323	Fossasia Open Event Server	Low	0.24	3.7	May 29, 2025	A vulnerability, which was classified as problematic, has been found in fossasia open-event-server 1.19.1. This issue affects the function send_email_change_user_email of the file /fossasia/open-event-server/blob/development/app/api/helpers/mail.py of the component Mail…
CVE-2010-3300	—		0.00	—	Jun 22, 2021	It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.

CVE-2024-10772HigDec 6, 2024
risk 0.57cvss 8.8epss 0.00
Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.
CVE-2025-41351MedJan 28, 2026
Funambol
Funambol Cloud Server
risk 0.39cvss —epss 0.00
Vulnerability that allows a Padding Oracle Attack to be performed on the Funambol v30.0.0.20 cloud server. The thumbnail display URL allows an attacker to decrypt and encrypt the parameters used by the application to generate ‘self-signed’ access URLs.
CVE-2024-36279MedJun 17, 2024
FreeFrom
FreeFrom
risk 0.34cvss 5.3epss 0.00
Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may…
CVE-2025-5323LowMay 29, 2025
Fossasia
Open Event Server
risk 0.24cvss 3.7epss 0.00
A vulnerability, which was classified as problematic, has been found in fossasia open-event-server 1.19.1. This issue affects the function send_email_change_user_email of the file /fossasia/open-event-server/blob/development/app/api/helpers/mail.py of the component Mail…
CVE-2010-3300Jun 22, 2021
risk 0.00cvss —epss 0.00
It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.