CAPEC™ 218: Spoofing of UDDI/ebXML Messages
Description
An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business transaction. UDDI, ebXML, and similar standards are used to identify businesses in e-business transactions. Among other things, they identify a particular participant, WSDL information for SOAP transactions, and supported communication protocols, including security protocols. By spoofing one of these messages an attacker could impersonate a legitimate business in a transaction or could manipulate the protocols used between a client and business. This could result in disclosure of sensitive information, loss of message integrity, or even financial fraud.
Source: CAPEC™ 218
Related ASVS Requirements
ASVS (5.0): 11.2.1, 11.2.3, 11.2.4, 11.2.5, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.4.1, 11.4.3, 11.5.1, 11.5.2, 11.6.1, 11.6.2, 16.3.3, 16.3.4, 2.2.1, 2.2.2, 4.1.5
