Meta attack pattern
Stable
CAPEC-248: Command Injection
An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.
High
Typical severity
Per MITRE
Medium
Likelihood of attack
Per MITRE
1
Related weaknesses
CWEs this targets
Meta
Abstraction
MITRE classification
Overview
CAPEC-248 (Command Injection) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.