Weakness (CWE)
CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
How to prevent it (2 mitigations)
-
Architecture and Design
Enforce the use of strong mutual authentication mechanism between the two parties.
-
Architecture and Design
Whenever a product is an intermediary or proxy for
transactions between two other components, the proxy core
should not drop the identity of the initiator of the
transaction. The immutability of the identity of the
initiator must be maintained and should be forwarded all the
way to the target.
Source: MITRE CWE-441
4 results · Clear filters · Feed
-
High 7.5CVE-2026-46592 Public exploit
Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation
Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespa…
-
High 8.4CVE-2026-0013 Public exploit
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confus…
-
High 7.8CVE-2025-32324 Public exploit
In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deput…
-
High 7.3CVE-2025-22441 Public exploit
In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary j…