{
  "node_id": "mitre-capec-capec-39-manipulating-opaque-client-based-data-tokens",
  "title": "MITRE CAPEC-39: Manipulating Opaque Client-based Data Tokens (Standard Attack Pattern - Medium Severity)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-05-25",
  "bluf": "MITRE CAPEC-39 (Manipulating Opaque Client-based Data Tokens) is a standard-level attack pattern in the MITRE Common Attack Pattern Enumeration and Classification. In circumstances where an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) that data can be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker. Likelihood of attack: High. Typical severity: Medium. Parent pattern for CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies. Maps to weaknesses CWE-353, CWE-285, CWE-302, CWE-472, and others.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_attack"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-sp-800-53-r5",
    "iso-27001-2022",
    "cis-controls-v8",
    "owasp-asvs-l2"
  ],
  "primary_citations_count": 10
}