The product does not properly protect an assumed-immutable element from being modified by an attacker.
View on MITREThis occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.
Common data types that are attacked are environment variables, web application parameters, and HTTP headers.
When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.
No detection method information available for this CWE.
In the code excerpt below, an array returned by a Java method is modified despite the fact that arrays are mutable.
Gain privileges by modifying assumed-immutable code addresses that are accessed by a driver.
View DetailsNo relationship information available for this CWE.
CWE-471: Modification of Assumed-Immutable Data (MAID) is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not properly protect an assumed-immutable element from being modified by an attacker. This occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.
If exploited, CWE-471 (Modification of Assumed-Immutable Data (MAID)) it can compromise Integrity, leading to outcomes such as Modify Application Data and Unexpected State.
Recommended mitigations for CWE-471 include: When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.
CWE-471 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-471, including CVE-2002-1757 and CVE-2005-1905. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-471 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.