The description above is MITRE’s definition of CWE-353 in CWE 4.20, a base-level weakness.
Common consequences MITRE lists
- Integrity, Other: Other
- Non-Repudiation, Other: Hide Activities; Other
Guides on this site
Padding oracle attacks
Use a byte-level CBC example to see how a tiny validity signal becomes plaintext information, then design verification that checks more than the error message.
WEP: RC4 key reuse and weak IVs
Separate WEP’s repeated-keystream failure, weak-IV key recovery, and unkeyed integrity weakness through a concrete two-packet exercise.
AEAD records: AES-GCM nonces, associated data and key limits
Build an encrypted record whose tag binds ciphertext to the intended tenant, record, purpose and format, keep nonces unique within each key’s usage limit, and verify the design with actual AES-GCM.
Practice
- AES-GCM nonce reuse lab: Fix a nonce allocator that breaks after restart · Browser lab
- Bind ciphertext to the correct record · Local project
References
This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-353.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.