The software uses obfuscation or encryption of inputs that
					should not be mutable by an external actor, but the software does not use
					integrity checks to detect if those inputs have been
					modified.When an application relies on obfuscation or incorrectly applied / weak
						encryption to protect client-controllable tokens or parameters, that may
						have an effect on the user state, system state, or some decision made on the
						server. Without protecting the tokens/parameters for integrity, the
						application is vulnerable to an attack where an adversary blindly traverses
						the space of possible values of the said token/parameter in order to attempt
						to gain an advantage. The goal of the attacker is to find another admissible
						value that will somehow elevate his or her privileges in the system,
						disclose information or change the behavior of the system in some way
						beneficial to the attacker. If the application does not protect these
						critical tokens/parameters for integrity, it will not be able to determine
						that these values have been tampered with. Measures that are used to protect
						data for confidentiality should not be relied upon to provide the integrity
						service.