Standard attack pattern
Draft
CAPEC-250: XML Injection
An attacker utilizes crafted XML user-controllable input to probe, attack, and inject data into the XML database, using techniques similar to SQL injection. The user-controllable input can allow for unauthorized viewing of data, bypassing authentication or the front-end application for direct XML database access, and possibly altering database information.
Not rated
Typical severity
Per MITRE
High
Likelihood of attack
Per MITRE
4
Related weaknesses
CWEs this targets
Standard
Abstraction
MITRE classification
Overview
CAPEC-250 (XML Injection) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.