CWE - VIEW SLICE: CWE-1344: Weaknesses in OWASP Top Ten (2021) (4.17)

CWE VIEW: Weaknesses in OWASP Top Ten (2021)

View ID: 1344

Vulnerability Mapping: PROHIBITED This CWE ID must not be used to map to real-world vulnerabilities
Type: Graph

Downloads: Booklet | CSV | XML

Objective

CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021.

Audience

Stakeholder	Description
Software Developers	This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing a good starting point for web application developers who want to code more securely.
Product Customers	This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators	Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

Relationships

div.collapseblock { display:inline }

The following graph shows the tree-like relationships between weaknesses that exist at different levels of abstraction. At the highest level, categories and pillars exist to group weaknesses. Categories (which are not technically weaknesses) are special CWE entries used to group weaknesses that share a common characteristic. Pillars are weaknesses that are described in the most abstract fashion. Below these top-level entries are weaknesses are varying levels of abstraction. Classes are still very abstract, typically independent of any specific language or technology. Base level weaknesses are used to present a more specific type of weakness. A variant is a weakness that is described at a very low level of detail, typically limited to a specific language or technology. A chain is a set of weaknesses that must be reachable consecutively in order to produce an exploitable vulnerability. While a composite is a set of weaknesses that must all be present simultaneously in order to produce an exploitable vulnerability.

Show Details:

Expand All | Collapse All

1344 - Weaknesses in OWASP Top Ten (2021)

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A01:2021 - Broken Access Control - (1345)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control)

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - (22)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Directory traversal Path traversal

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 23 (Relative Path Traversal)

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. Zip Slip

Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. Path Traversal: '.../...//' - (35)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 35 (Path Traversal: '.../...//')

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Link Resolution Before File Access ('Link Following') - (59)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 59 (Improper Link Resolution Before File Access ('Link Following'))

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. insecure temporary file Zip Slip

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Exposure of Sensitive Information to an Unauthorized Actor - (200)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 200 (Exposure of Sensitive Information to an Unauthorized Actor)

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Information Disclosure Information Leak

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Insertion of Sensitive Information Into Sent Data - (201)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 201 (Insertion of Sensitive Information Into Sent Data)

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 219 (Storage of File with Sensitive Data Under Web Root)

The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

Category - a CWE entry that contains a set of other entries that share a common characteristic. Permissions, Privileges, and Access Controls - (264)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 264 (Permissions, Privileges, and Access Controls)

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Category - a CWE entry that contains a set of other entries that share a common characteristic. Permission Issues - (275)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 275 (Permission Issues)

Weaknesses in this category are related to improper assignment or handling of permissions.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 276 (Incorrect Default Permissions)

During installation, installed file permissions are set to allow anyone to modify those files.

Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. Improper Access Control - (284)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 284 (Improper Access Control)

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Authorization

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 285 (Improper Authorization)

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. AuthZ

Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. Cross-Site Request Forgery (CSRF) - (352)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 352 (Cross-Site Request Forgery (CSRF))

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. Session Riding Cross Site Reference Forgery XSRF CSRF

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Exposure of Private Personal Information to an Unauthorized Actor - (359)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 359 (Exposure of Private Personal Information to an Unauthorized Actor)

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. Privacy violation Privacy leak Privacy leakage

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 377 (Insecure Temporary File)

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Transmission of Private Resources into a New Sphere ('Resource Leak') - (402)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product. Resource Leak

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 425 (Direct Request ('Forced Browsing'))

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. forced browsing

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Unintended Proxy or Intermediary ('Confused Deputy') - (441)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 441 (Unintended Proxy or Intermediary ('Confused Deputy'))

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. Confused Deputy

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Exposure of Sensitive System Information to an Unauthorized Control Sphere - (497)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere)

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Insertion of Sensitive Information into Externally-Accessible File or Directory - (538)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 538 (Insertion of Sensitive Information into Externally-Accessible File or Directory)

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Inclusion of Sensitive Information in Source Code - (540)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 540 (Inclusion of Sensitive Information in Source Code)

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 548 (Exposure of Information Through Directory Listing)

The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Files or Directories Accessible to External Parties - (552)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 552 (Files or Directories Accessible to External Parties)

The product makes files or directories accessible to unauthorized actors, even though they should not be.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 566 (Authorization Bypass Through User-Controlled SQL Primary Key)

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. URL Redirection to Untrusted Site ('Open Redirect') - (601)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 601 (URL Redirection to Untrusted Site ('Open Redirect'))

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. Open Redirect Cross-site Redirect Cross-domain Redirect Unvalidated Redirect

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Authorization Bypass Through User-Controlled Key - (639)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 639 (Authorization Bypass Through User-Controlled Key)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Insecure Direct Object Reference / IDOR Broken Object Level Authorization / BOLA Horizontal Authorization

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 651 (Exposure of WSDL File Containing Sensitive Information)

The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 668 (Exposure of Resource to Wrong Sphere)

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Use of Incorrectly-Resolved Name or Reference - (706)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 706 (Use of Incorrectly-Resolved Name or Reference)

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 862 (Missing Authorization)

The product does not perform an authorization check when an actor attempts to access a resource or perform an action. AuthZ

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 863 (Incorrect Authorization)

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. AuthZ

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Improper Control of Dynamically-Managed Code Resources - (913)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 913 (Improper Control of Dynamically-Managed Code Resources)

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 922 (Insecure Storage of Sensitive Information)

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 1275 (Sensitive Cookie with Improper SameSite Attribute)

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures - (1346)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures)

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 261 (Weak Encoding for Password)

Obscuring a password with a trivial encoding does not protect the password.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Following of a Certificate's Chain of Trust - (296)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 296 (Improper Following of a Certificate's Chain of Trust)

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

Category - a CWE entry that contains a set of other entries that share a common characteristic. Cryptographic Issues - (310)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 310 (Cryptographic Issues)

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Cleartext Transmission of Sensitive Information - (319)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 319 (Cleartext Transmission of Sensitive Information)

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 321 (Use of Hard-coded Cryptographic Key)

The product uses a hard-coded, unchangeable cryptographic key.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 322 (Key Exchange without Entity Authentication)

The product performs a key exchange with an actor without verifying the identity of that actor.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 323 (Reusing a Nonce, Key Pair in Encryption)

Nonces should be used for the present occasion and only once.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 324 (Use of a Key Past its Expiration Date)

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 325 (Missing Cryptographic Step)

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 326 (Inadequate Encryption Strength)

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Use of a Broken or Risky Cryptographic Algorithm - (327)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 327 (Use of a Broken or Risky Cryptographic Algorithm)

The product uses a broken or risky cryptographic algorithm or protocol.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 328 (Use of Weak Hash)

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 329 (Generation of Predictable IV with CBC Mode)

The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 330 (Use of Insufficiently Random Values)

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 331 (Insufficient Entropy)

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) - (335)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 335 (Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG))

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 336 (Same Seed in Pseudo-Random Number Generator (PRNG))

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 337 (Predictable Seed in Pseudo-Random Number Generator (PRNG))

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - (338)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 338 (Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG))

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Generation of Predictable Numbers or Identifiers - (340)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 340 (Generation of Predictable Numbers or Identifiers)

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 347 (Improper Verification of Cryptographic Signature)

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 523 (Unprotected Transport of Credentials)

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2007 Category A9 - Insecure Communications - (720)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 720 (OWASP Top Ten 2007 Category A9 - Insecure Communications)

Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2007.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') - (757)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 757 (Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'))

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 759 (Use of a One-Way Hash without a Salt)

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 760 (Use of a One-Way Hash with a Predictable Salt)

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 780 (Use of RSA Algorithm without OAEP)

The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection - (818)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 818 (OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection)

Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2010.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Use of Password Hash With Insufficient Computational Effort - (916)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 916 (Use of Password Hash With Insufficient Computational Effort)

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A03:2021 - Injection - (1347)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection)

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top Ten 2021.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 20 (Improper Input Validation)

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - (74)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) - (75)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 75 (Failure to Sanitize Special Elements into a Different Plane (Special Element Injection))

The product does not adequately filter user-controlled input for special elements with control implications.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Improper Neutralization of Special Elements used in a Command ('Command Injection') - (77)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Command injection

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - (78)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Shell injection Shell metacharacters OS Command Injection

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. XSS HTML Injection Reflected XSS / Non-Persistent XSS / Type 1 XSS Stored XSS / Persistent XSS / Type 2 XSS DOM-Based XSS / Type 0 XSS CSS

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 83 (Improper Neutralization of Script in Attributes in a Web Page)

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 87 (Improper Neutralization of Alternate XSS Syntax)

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') - (88)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. SQL injection SQLi

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') - (90)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 91 (XML Injection (aka Blind XPath Injection))

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of CRLF Sequences ('CRLF Injection') - (93)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Control of Generation of Code ('Code Injection') - (94)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 94 (Improper Control of Generation of Code ('Code Injection'))

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Code Injection

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') - (96)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 96 (Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection'))

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 97 (Improper Neutralization of Server-Side Includes (SSI) Within a Web Page)

The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'))

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. Remote file include RFI Local file inclusion

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Improper Control of Resource Identifiers ('Resource Injection') - (99)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 99 (Improper Control of Resource Identifiers ('Resource Injection'))

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. Insecure Direct Object Reference

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'))

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. HTTP Request Splitting HTTP Response Splitting

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 116 (Improper Encoding or Escaping of Output)

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. Output Sanitization Output Validation Output Encoding

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Improper Neutralization of Special Elements - (138)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 138 (Improper Neutralization of Special Elements)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 184 (Incomplete List of Disallowed Inputs)

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete. Denylist / Deny List Blocklist / Block List Blacklist / Black List

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') - (470)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'))

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. Reflection Injection

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Modification of Assumed-Immutable Data (MAID) - (471)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 471 (Modification of Assumed-Immutable Data (MAID))

The product does not properly protect an assumed-immutable element from being modified by an attacker.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 564 (SQL Injection: Hibernate)

Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Externally Controlled Reference to a Resource in Another Sphere - (610)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 610 (Externally Controlled Reference to a Resource in Another Sphere)

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Data within XPath Expressions ('XPath Injection') - (643)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 643 (Improper Neutralization of Data within XPath Expressions ('XPath Injection'))

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 644 (Improper Neutralization of HTTP Headers for Scripting Syntax)

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') - (652)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 652 (Improper Neutralization of Data within XQuery Expressions ('XQuery Injection'))

The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') - (917)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'))

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed. EL Injection

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A04:2021 - Insecure Design - (1348)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design)

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top Ten 2021.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 73 (External Control of File Name or Path)

The product allows user input to control or influence paths or file names that are used in filesystem operations.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 183 (Permissive List of Allowed Inputs)

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. Allowlist / Allow List Safelist / Safe List Whitelist / White List

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Generation of Error Message Containing Sensitive Information - (209)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 209 (Generation of Error Message Containing Sensitive Information)

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Exposure of Sensitive Information Due to Incompatible Policies - (213)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 213 (Exposure of Sensitive Information Due to Incompatible Policies)

The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 235 (Improper Handling of Extra Parameters)

The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 256 (Plaintext Storage of a Password)

Storing a password in plaintext may result in a system compromise.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 257 (Storing Passwords in a Recoverable Format)

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 266 (Incorrect Privilege Assignment)

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 269 (Improper Privilege Management)

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Handling of Insufficient Permissions or Privileges - (280)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 280 (Improper Handling of Insufficient Permissions or Privileges )

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 311 (Missing Encryption of Sensitive Data)

The product does not encrypt sensitive or critical information before storage or transmission.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 312 (Cleartext Storage of Sensitive Information)

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 313 (Cleartext Storage in a File or on Disk)

The product stores sensitive information in cleartext in a file, or on disk.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 316 (Cleartext Storage of Sensitive Information in Memory)

The product stores sensitive information in cleartext in memory.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 419 (Unprotected Primary Channel)

The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 430 (Deployment of Wrong Handler)

The wrong "handler" is assigned to process an object.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Unrestricted Upload of File with Dangerous Type - (434)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 434 (Unrestricted Upload of File with Dangerous Type)

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. Unrestricted File Upload

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') - (444)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. HTTP Request Smuggling HTTP Response Smuggling HTTP Smuggling

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. User Interface (UI) Misrepresentation of Critical Information - (451)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 451 (User Interface (UI) Misrepresentation of Critical Information)

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. External Control of Assumed-Immutable Web Parameter - (472)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 472 (External Control of Assumed-Immutable Web Parameter)

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. Assumed-Immutable Parameter Tampering

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 501 (Trust Boundary Violation)

The product mixes trusted and untrusted data in the same data structure or structured message.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 522 (Insufficiently Protected Credentials)

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 525 (Use of Web Browser Cache Containing Sensitive Information)

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 539 (Use of Persistent Cookies Containing Sensitive Information)

The web application uses persistent cookies, but the cookies contain sensitive information.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 579 (J2EE Bad Practices: Non-serializable Object Stored in Session)

The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 598 (Use of GET Request Method With Sensitive Query Strings)

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Client-Side Enforcement of Server-Side Security - (602)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 602 (Client-Side Enforcement of Server-Side Security)

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 642 (External Control of Critical State Data)

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 646 (Reliance on File Name or Extension of Externally-Supplied File)

The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 650 (Trusting HTTP Permission Methods on the Server Side)

The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 653 (Improper Isolation or Compartmentalization)

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions. Separation of Privilege

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 656 (Reliance on Security Through Obscurity)

The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism. Never Assuming your secrets are safe

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 657 (Violation of Secure Design Principles)

The product violates well-established principles for secure design.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 799 (Improper Control of Interaction Frequency)

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. Insufficient anti-automation Brute force

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Reliance on Untrusted Inputs in a Security Decision - (807)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 807 (Reliance on Untrusted Inputs in a Security Decision)

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Category - a CWE entry that contains a set of other entries that share a common characteristic. Business Logic Errors - (840)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 840 (Business Logic Errors)

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 841 (Improper Enforcement of Behavioral Workflow)

The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 927 (Use of Implicit Intent for Sensitive Communication)

The Android application uses an implicit intent for transmitting sensitive data to other applications.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Restriction of Rendered UI Layers or Frames - (1021)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 1021 (Improper Restriction of Rendered UI Layers or Frames)

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Clickjacking UI Redress Attack Tapjacking

1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 1173 (Improper Use of Validation Framework)

The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration - (1349)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration)

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top Ten 2021.

Category - a CWE entry that contains a set of other entries that share a common characteristic. 7PK - Environment - (2)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 2 (7PK - Environment)

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 11 (ASP.NET Misconfiguration: Creating Debug Binary)

Debugging messages help attackers learn about the system and plan a form of attack.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 13 (ASP.NET Misconfiguration: Password in Configuration File)

Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. External Control of System or Configuration Setting - (15)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 15 (External Control of System or Configuration Setting)

One or more system settings or configuration elements can be externally controlled by a user.

Category - a CWE entry that contains a set of other entries that share a common characteristic. Configuration - (16)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 16 (Configuration)

Weaknesses in this category are typically introduced during the configuration of the software.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 260 (Password in Configuration File)

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 315 (Cleartext Storage of Sensitive Information in a Cookie)

The product stores sensitive information in cleartext in a cookie.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 520 (.NET Misconfiguration: Use of Impersonation)

Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 526 (Cleartext Storage of Sensitive Information in an Environment Variable)

The product uses an environment variable to store unencrypted sensitive information.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 537 (Java Runtime Error Message Containing Sensitive Information)

In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 541 (Inclusion of Sensitive Information in an Include File)

If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Use of Hard-coded, Security-relevant Constants - (547)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 547 (Use of Hard-coded, Security-relevant Constants)

The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Restriction of XML External Entity Reference - (611)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 611 (Improper Restriction of XML External Entity Reference)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. XXE

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute)

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 756 (Missing Custom Error Page)

The product does not return custom error pages to the user, possibly exposing sensitive information.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') - (776)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 776 (Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'))

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. XEE Billion Laughs Attack XML Bomb

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 942 (Permissive Cross-domain Policy with Untrusted Domains)

The product uses a cross-domain policy file that includes domains that should not be trusted.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 1004 (Sensitive Cookie Without 'HttpOnly' Flag)

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2017 Category A6 - Security Misconfiguration - (1032)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 1032 (OWASP Top Ten 2017 Category A6 - Security Misconfiguration)

Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2017.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 1174 (ASP.NET Misconfiguration: Improper Model Validation)

The ASP.NET application does not use, or incorrectly uses, the model validation framework.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components - (1352)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components)

Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top Ten 2021.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities - (937)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components) > 937 (OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities)

Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities - (1035)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components) > 1035 (OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities)

Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Use of Unmaintained Third Party Components - (1104)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components) > 1104 (Use of Unmaintained Third Party Components)

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures - (1353)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures)

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top Ten 2021.

Category - a CWE entry that contains a set of other entries that share a common characteristic. Credentials Management Errors - (255)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 255 (Credentials Management Errors)

Weaknesses in this category are related to the management of credentials.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 259 (Use of Hard-coded Password)

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 287 (Improper Authentication)

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. authentification AuthN AuthC

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Authentication Bypass Using an Alternate Path or Channel - (288)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 288 (Authentication Bypass Using an Alternate Path or Channel)

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 290 (Authentication Bypass by Spoofing)

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 294 (Authentication Bypass by Capture-replay)

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 295 (Improper Certificate Validation)

The product does not validate, or incorrectly validates, a certificate.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 297 (Improper Validation of Certificate with Host Mismatch)

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 300 (Channel Accessible by Non-Endpoint)

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. Adversary-in-the-Middle / AITM Man-in-the-Middle / MITM Person-in-the-Middle / PITM Monkey-in-the-Middle Monster-in-the-Middle Manipulator-in-the-Middle On-path attack Interception attack

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Authentication Bypass by Assumed-Immutable Data - (302)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 302 (Authentication Bypass by Assumed-Immutable Data)

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 304 (Missing Critical Step in Authentication)

The product implements an authentication technique, but it skips a step that weakens the technique.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Missing Authentication for Critical Function - (306)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 306 (Missing Authentication for Critical Function)

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Restriction of Excessive Authentication Attempts - (307)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 307 (Improper Restriction of Excessive Authentication Attempts)

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 346 (Origin Validation Error)

The product does not properly verify that the source of data or communication is valid.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 384 (Session Fixation)

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 521 (Weak Password Requirements)

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 613 (Insufficient Session Expiration)

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 620 (Unverified Password Change)

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Weak Password Recovery Mechanism for Forgotten Password - (640)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 640 (Weak Password Recovery Mechanism for Forgotten Password)

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 798 (Use of Hard-coded Credentials)

The product contains hard-coded credentials, such as a password or cryptographic key.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improper Verification of Source of a Communication Channel - (940)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 940 (Improper Verification of Source of a Communication Channel)

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Category - a CWE entry that contains a set of other entries that share a common characteristic. Lockout Mechanism Errors - (1216)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 1216 (Lockout Mechanism Errors)

Weaknesses in this category are related to a software system's lockout mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts to access a given resource. The weaknesses in this category could lead to a degradation of access to system assets if they are not addressed.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures - (1354)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures)

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top Ten 2021.

Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. Insufficient Verification of Data Authenticity - (345)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 345 (Insufficient Verification of Data Authenticity)

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 353 (Missing Support for Integrity Check)

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 426 (Untrusted Search Path)

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Untrusted Path

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 494 (Download of Code Without Integrity Check)

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 502 (Deserialization of Untrusted Data)

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. Marshaling, Unmarshaling Pickling, Unpickling PHP Object Injection

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Reliance on Cookies without Validation and Integrity Checking - (565)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 565 (Reliance on Cookies without Validation and Integrity Checking)

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 784 (Reliance on Cookies without Validation and Integrity Checking in a Security Decision)

The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Inclusion of Functionality from Untrusted Control Sphere - (829)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 829 (Inclusion of Functionality from Untrusted Control Sphere)

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 830 (Inclusion of Web Functionality from an Untrusted Source)

The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Improperly Controlled Modification of Dynamically-Determined Object Attributes - (915)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. Mass Assignment AutoBinding PHP Object Injection

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures - (1355)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures)

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top Ten 2021.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 117 (Improper Output Neutralization for Logs)

The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file. Log forging

1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 223 (Omission of Security-relevant Information)

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Insertion of Sensitive Information into Log File - (532)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 532 (Insertion of Sensitive Information into Log File)

The product writes sensitive information to a log file.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 778 (Insufficient Logging)

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Category - a CWE entry that contains a set of other entries that share a common characteristic. OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF) - (1356)

1344 (Weaknesses in OWASP Top Ten (2021)) > 1356 (OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF))

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top Ten 2021.

1344 (Weaknesses in OWASP Top Ten (2021)) > 1356 (OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF)) > 918 (Server-Side Request Forgery (SSRF))

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. XSPA SSRF

Vulnerability Mapping Notes

Usage: PROHIBITED

(this CWE ID must not be used to map to real-world vulnerabilities)

Reason: View

Rationale:

This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.

Comments:

Use this View or other Views to search and navigate for the appropriate weakness.

Notes

Maintenance

As of CWE 4.6, the relationships in this view were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

References

[REF-1206] "OWASP Top 10:2021". OWASP. 2021-09-24. <https://owasp.org/Top10/>.

View Metrics

	CWEs in this view		Total CWEs
Weaknesses	182	out of	943
Categories	23	out of	374
Views	0	out of	51
Total	205	out of	1368

Content History

Submissions
Submission Date	Submitter	Organization
2021-10-05 (CWE 4.6, 2021-10-28)	CWE Content Team	MITRE
2021-10-05 (CWE 4.6, 2021-10-28)
Modifications
Modification Date	Modifier	Organization
2023-06-29	CWE Content Team	MITRE
2023-06-29	updated Mapping_Notes

View Components

Weakness ID: 312

Vulnerability Mapping: ALLOWED This CWE ID may be used to map to real-world vulnerabilities
Abstraction: Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.

View customized information:

For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.

Description

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Common Consequences

This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

Impact	Details
Read Application Data	Scope: Confidentiality An attacker with access to the system could read sensitive information stored in cleartext (i.e., unencrypted). Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Potential Mitigations

Phase(s)	Mitigation
Implementation; System Configuration; Operation	When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Implementation; System Configuration; Operation	In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Relationships

This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

Relevant to the view "Research Concepts" (View-1000)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	311	Missing Encryption of Sensitive Data
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	922	Insecure Storage of Sensitive Information
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	313	Cleartext Storage in a File or on Disk
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	314	Cleartext Storage in the Registry
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	315	Cleartext Storage of Sensitive Information in a Cookie
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	316	Cleartext Storage of Sensitive Information in Memory
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	317	Cleartext Storage of Sensitive Information in GUI
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	318	Cleartext Storage of Sensitive Information in Executable
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	526	Cleartext Storage of Sensitive Information in an Environment Variable

Relevant to the view "Software Development" (View-699)

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	199	Information Management Errors

Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (View-1003)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	311	Missing Encryption of Sensitive Data

Relevant to the view "Architectural Concepts" (View-1008)

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1013	Encrypt Data

Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

Phase	Note
Architecture and Design	OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Applicable Platforms

This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages	Class: Not Language-Specific (Undetermined Prevalence)
Technologies	Class: Cloud Computing (Undetermined Prevalence) Class: ICS/OT (Undetermined Prevalence) Class: Mobile (Undetermined Prevalence)

Demonstrative Examples

Example 1

The following code excerpt stores a plaintext user account ID in a browser cookie.

(bad code)

Example Language: Java

response.addCookie( new Cookie("userAccountID", acctID);

Because the account ID is in plaintext, the user's account information is exposed if their computer is compromised by an attacker.

Example 2

This code writes a user's login information to a cookie so the user does not have to login again later.

(bad code)

Example Language: PHP

function persistLogin($username, $password){

$data = array("username" => $username, "password"=> $password);
setcookie ("userdata", $data);

}

The code stores the user's username and password in plaintext in a cookie on the user's machine. This exposes the user's login information if their computer is compromised by an attacker. Even if the user's machine is not compromised, this weakness combined with cross-site scripting (CWE-79) could allow an attacker to remotely copy the cookie.

Also note this example code also exhibits Plaintext Storage in a Cookie (CWE-315).

Example 3

The following code attempts to establish a connection, read in a password, then store it to a buffer.

(bad code)

Example Language: C

server.sin_family = AF_INET; hp = gethostbyname(argv[1]);
if (hp==NULL) error("Unknown host");
memcpy( (char *)&server.sin_addr,(char *)hp->h_addr,hp->h_length);
if (argc < 3) port = 80;
else port = (unsigned short)atoi(argv[3]);
server.sin_port = htons(port);
if (connect(sock, (struct sockaddr *)&server, sizeof server) < 0) error("Connecting");
...
while ((n=read(sock,buffer,BUFSIZE-1))!=-1) {

write(dfd,password_buffer,n);
...

While successful, the program does not encrypt the data before writing it to a buffer, possibly exposing it to unauthorized actors.

Example 4

The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.

This Java example shows a properties file with a cleartext username / password pair.

(bad code)

Example Language: Java

# Java Web App ResourceBundle properties file
...
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
...

The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database but the pair is stored in cleartext.

(bad code)

Example Language: ASP.NET

...
<connectionStrings>

</connectionStrings>
...

Username and password information should not be included in a configuration file or a properties file in cleartext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information.

Example 5

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.

At least one OT product stored a password in plaintext.

Example 6

In 2021, a web site operated by PeopleGIS stored data of US municipalities in Amazon Web Service (AWS) Simple Storage Service (S3) buckets.

(bad code)

Example Language: Other

A security researcher found 86 S3 buckets that could be accessed without authentication (CWE-306) and stored data unencrypted (CWE-312). These buckets exposed over 1000 GB of data and 1.6 million files including physical addresses, phone numbers, tax documents, pictures of driver's license IDs, etc. [REF-1296] [REF-1295]

While it was not publicly disclosed how the data was protected after discovery, multiple options could have been considered.

(good code)

Example Language: Other

The sensitive information could have been protected by ensuring that the buckets did not have public read access, e.g., by enabling the s3-account-level-public-access-blocks-periodic rule to Block Public Access. In addition, the data could have been encrypted at rest using the appropriate S3 settings, e.g., by enabling server-side encryption using the s3-bucket-server-side-encryption-enabled setting. Other settings are available to further prevent bucket data from being leaked. [REF-1297]

Example 7

Consider the following PowerShell command examples for encryption scopes of Azure storage objects. In the first example, an encryption scope is set for the storage account.

(bad code)

Example Language: Shell

New-AzStorageEncryptionScope -ResourceGroupName "MyResourceGroup" -AccountName "MyStorageAccount" -EncryptionScopeName testscope -StorageEncryption

The result (edited and formatted for readability) might be:

(bad code)

Example Language: Other

ResourceGroupName: MyResourceGroup, StorageAccountName: MyStorageAccount

Name	State	Source	RequireInfrastructureEncryption
testscope	Enabled	Microsoft.Storage

However, the empty string under RequireInfrastructureEncryption indicates this service was not enabled at the time of creation, because the -RequireInfrastructureEncryption argument was not specified in the command.

Including the -RequireInfrastructureEncryption argument addresses the issue:

(good code)

Example Language: Shell

New-AzStorageEncryptionScope -ResourceGroupName "MyResourceGroup" -AccountName "MyStorageAccount" -EncryptionScopeName testscope -StorageEncryption -RequireInfrastructureEncryption

This produces the report:

(result)

Example Language: Other

ResourceGroupName: MyResourceGroup, StorageAccountName: MyStorageAccount

Name	State	Source	RequireInfrastructureEncryption
testscope	Enabled	Microsoft.Keyvault	True

In a scenario where both software and hardware layer encryption is required ("double encryption"), Azure's infrastructure encryption setting can be enabled via the CLI or Portal. An important note is that infrastructure hardware encryption cannot be enabled or disabled after a blob is created. Furthermore, the default value for infrastructure encryption is disabled in blob creations.

Selected Observed Examples

Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.

Reference	Description
CVE-2022-30275	Remote Terminal Unit (RTU) uses a driver that relies on a password stored in plaintext.
CVE-2009-2272	password and username stored in cleartext in a cookie
CVE-2009-1466	password stored in cleartext in a file with insecure permissions
CVE-2009-0152	chat program disables SSL in some circumstances even when the user says to use SSL.
CVE-2009-1603	Chain: product uses an incorrect public exponent when generating an RSA key, which effectively disables the encryption
CVE-2009-0964	storage of unencrypted passwords in a database
CVE-2008-6157	storage of unencrypted passwords in a database
CVE-2008-6828	product stores a password in cleartext in memory
CVE-2008-1567	storage of a secret key in cleartext in a temporary file
CVE-2008-0174	SCADA product uses HTTP Basic Authentication, which is not encrypted
CVE-2007-5778	login credentials stored unencrypted in a registry key
CVE-2001-1481	Plaintext credentials in world-readable file.
CVE-2005-1828	Password in cleartext in config file.
CVE-2005-2209	Password in cleartext in config file.
CVE-2002-1696	Decrypted copy of a message written to disk given a combination of options and when user replies to an encrypted message.
CVE-2004-2397	Plaintext storage of private key and passphrase in log file when user imports the key.
CVE-2002-1800	Admin password in plaintext in a cookie.
CVE-2001-1537	Default configuration has cleartext usernames/passwords in cookie.
CVE-2001-1536	Usernames/passwords in cleartext in cookies.
CVE-2005-2160	Authentication information stored in cleartext in a cookie.

Detection Methods

Method

Details

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Memberships

This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	816	OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	884	CWE Cross-section
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	934	OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	963	SFP Secondary Cluster: Exposed Data
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1029	OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1348	OWASP Top Ten 2021 Category A04:2021 - Insecure Design
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1366	ICS Communications: Frail Security in Protocols
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1368	ICS Dependencies (& Architecture): External Digital Systems
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1402	Comprehensive Categorization: Encryption

Vulnerability Mapping Notes

Usage	ALLOWED (this CWE ID may be used to map to real-world vulnerabilities)
Reason	Acceptable-Use
Rationale	This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comments	Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Notes

Terminology

Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption. However, within cryptography, these have more precise meanings. Plaintext is the information just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is any information that is unencrypted, although it might be in an encoded form that is not easily human-readable (such as base64 encoding).

Other

When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Mapped Node Name
PLOVER		Plaintext Storage of Sensitive Information
Software Fault Patterns	SFP23	Exposed Data
ISA/IEC 62443	Part 4-2	Req CR 4.1 a)
ISA/IEC 62443	Part 3-3	Req SR 4.1

Related Attack Patterns

CAPEC-ID	Attack Pattern Name
CAPEC-37	Retrieve Embedded Sensitive Data

References

[REF-7]	Michael Howard and David LeBlanc. "Writing Secure Code". Chapter 9, "Protecting Secret Data" Page 299. 2nd Edition. Microsoft Press. 2002-12-04. <https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223>.
[REF-62]	Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security Assessment". Chapter 2, "Common Vulnerabilities of Encryption", Page 43. 1st Edition. Addison Wesley. 2006.
[REF-172]	Chris Wysopal. "Mobile App Top 10 List". 2010-12-13. <https://www.veracode.com/blog/2010/12/mobile-app-top-10-list>. (URL validated: 2023-04-07)
[REF-1283]	Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management". 2022-06-20. <https://www.forescout.com/resources/ot-icefall-report/>.
[REF-1295]	WizCase. "Over 80 US Municipalities' Sensitive Information, Including Resident's Personal Data, Left Vulnerable in Massive Data Breach". 2021-07-20. <https://www.wizcase.com/blog/us-municipality-breach-report/>.
[REF-1296]	Jonathan Greig. "1,000 GB of local government data exposed by Massachusetts software company". 2021-07-22. <https://www.zdnet.com/article/1000-gb-of-local-government-data-exposed-by-massachusetts-software-company/>.
[REF-1297]	Amazon. "AWS Foundational Security Best Practices controls". 2022. <https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html>. (URL validated: 2023-04-07)
[REF-1299]	Microsoft. "Azure encryption overview". 2022-08-18. <https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview>. (URL validated: 2022-10-11)
[REF-1301]	Google Cloud. "Default encryption at rest". 2022-10-11. <https://cloud.google.com/docs/security/encryption/default-encryption>. (URL validated: 2022-10-11)
[REF-1307]	Center for Internet Security. "CIS Microsoft Azure Foundations Benchmark version 1.5.0". Section 3.2. 2022-08-16. <https://www.cisecurity.org/benchmark/azure>. (URL validated: 2023-01-19)
[REF-1310]	Microsoft. "Enable infrastructure encryption for double encryption of data". 2022-07-14. <https://learn.microsoft.com/en-us/azure/storage/common/infrastructure-encryption-enable>. (URL validated: 2023-01-24)

Content History

Submissions
Submission Date	Submitter	Organization
2006-07-19 (CWE Draft 3, 2006-07-19)	PLOVER
2006-07-19 (CWE Draft 3, 2006-07-19)
Contributions
Contribution Date	Contributor	Organization
2023-04-25	"Mapping CWE to 62443" Sub-Working Group	CWE-CAPEC ICS/OT SIG
2023-04-25	Suggested mappings to ISA/IEC 62443.
Modifications
Modification Date	Modifier	Organization
2025-04-03 (CWE 4.17, 2025-04-03)	CWE Content Team	MITRE
2025-04-03 (CWE 4.17, 2025-04-03)	updated Common_Consequences, Description, Diagram, Other_Notes, Potential_Mitigations
2024-02-29 (CWE 4.14, 2024-02-29)	CWE Content Team	MITRE
2024-02-29 (CWE 4.14, 2024-02-29)	updated Taxonomy_Mappings
2023-06-29	CWE Content Team	MITRE
2023-06-29	updated Mapping_Notes, Relationships
2023-04-27	CWE Content Team	MITRE
2023-04-27	updated Detection_Factors, References, Relationships, Taxonomy_Mappings
2023-01-31	CWE Content Team	MITRE
2023-01-31	updated Applicable_Platforms, Demonstrative_Examples, Description, References, Relationships
2022-10-13	CWE Content Team	MITRE
2022-10-13	updated Applicable_Platforms, Demonstrative_Examples, Description, Observed_Examples, Potential_Mitigations, References
2021-10-28	CWE Content Team	MITRE
2021-10-28	updated Relationships
2021-03-15	CWE Content Team	MITRE
2021-03-15	updated Demonstrative_Examples
2020-02-24	CWE Content Team	MITRE
2020-02-24	updated Applicable_Platforms, Relationships
2019-06-20	CWE Content Team	MITRE
2019-06-20	updated Relationships, Type
2018-03-27	CWE Content Team	MITRE
2018-03-27	updated References, Relationships, Type
2018-01-23	CWE Content Team	MITRE
2018-01-23	updated Abstraction, Relationships
2017-11-08	CWE Content Team	MITRE
2017-11-08	updated Modes_of_Introduction, References, Relationships
2017-05-03	CWE Content Team	MITRE
2017-05-03	updated Related_Attack_Patterns
2014-07-30	CWE Content Team	MITRE
2014-07-30	updated Demonstrative_Examples, Relationships, Taxonomy_Mappings
2013-07-17	CWE Content Team	MITRE
2013-07-17	updated Description, Relationships, Terminology_Notes
2013-02-21	CWE Content Team	MITRE
2013-02-21	updated Applicable_Platforms, References
2012-05-11	CWE Content Team	MITRE
2012-05-11	updated Common_Consequences, Demonstrative_Examples, Observed_Examples, References, Related_Attack_Patterns, Relationships
2011-06-01	CWE Content Team	MITRE
2011-06-01	updated Common_Consequences
2010-06-21	CWE Content Team	MITRE
2010-06-21	updated Relationships
2010-02-16	CWE Content Team	MITRE
2010-02-16	updated References
2009-01-12	CWE Content Team	MITRE
2009-01-12	updated Description, Name
2008-09-08	CWE Content Team	MITRE
2008-09-08	updated Relationships, Taxonomy_Mappings
2008-07-01	Eric Dalci	Cigital
2008-07-01	updated Time_of_Introduction
Previous Entry Names
Change Date	Previous Entry Name
2009-01-12	Plaintext Storage of Sensitive Information

Weakness ID: 352 (Structure: Composite) Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability.

Vulnerability Mapping: ALLOWED This CWE ID may be used to map to real-world vulnerabilities

View customized information:

Description

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Alternate Terms

Session Riding
Cross Site Reference Forgery
XSRF
CSRF

Common Consequences

Impact

Details

Gain Privileges or Assume Identity; Bypass Protection Mechanism; Read Application Data; Modify Application Data; DoS: Crash, Exit, or Restart

Scope: Confidentiality, Integrity, Availability, Non-Repudiation, Access Control

The consequences will vary depending on the nature of the functionality that is vulnerable to CSRF. An attacker could trick a client into making an unintentional request to the web server via a URL, image load, XMLHttpRequest, etc., which would then be treated as an authentic request from the client - effectively performing any operations as the victim, leading to an exposure of data, unintended code execution, etc. If the victim is an administrator or privileged user, the consequences may include obtaining complete control over the web application - deleting or stealing data, uninstalling the product, or using it to launch other attacks against all of the product's users. Because the attacker has the identity of the victim, the scope of CSRF is limited only by the victim's privileges.

Potential Mitigations

Phase(s)	Mitigation
Architecture and Design	Strategy: Libraries or Frameworks Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330] Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Implementation	Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design	Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332] Note: Note that this can be bypassed using XSS (CWE-79).
Architecture and Design	Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation. Note: Note that this can be bypassed using XSS (CWE-79).
Architecture and Design	Use the "double-submitted cookie" method as described by Felten and Zeller: When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same. Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult. This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331] Note: Note that this can probably be bypassed using XSS (CWE-79), or when using web technologies that enable the attacker to read raw headers from HTTP requests.
Architecture and Design	Do not use the GET method for any request that triggers a state change.
Implementation	Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons. Note: Note that this can be bypassed using XSS (CWE-79). An attacker could use XSS to generate a spoofed Referer, or to generate a malicious request from a page whose Referer would be allowed.

Composite Components

Nature	Type	ID	Name
Requires	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	346	Origin Validation Error
Requires	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	441	Unintended Proxy or Intermediary ('Confused Deputy')
Requires	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	613	Insufficient Session Expiration
Requires	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	642	External Control of Critical State Data

Relationships

Relevant to the view "Research Concepts" (View-1000)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	345	Insufficient Verification of Data Authenticity
PeerOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CanFollow	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	1275	Sensitive Cookie with Improper SameSite Attribute

Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (View-1003)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	345	Insufficient Verification of Data Authenticity

Relevant to the view "Architectural Concepts" (View-1008)

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1019	Validate Inputs

Modes Of Introduction

Phase	Note
Architecture and Design	REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Applicable Platforms

Languages	Class: Not Language-Specific (Undetermined Prevalence)
Technologies	Web Server (Undetermined Prevalence)

Likelihood Of Exploit

Medium

Demonstrative Examples

Example 1

This example PHP code attempts to secure the form submission process by validating that the user submitting the form has a valid session. A CSRF attack would not be prevented by this countermeasure because the attacker forges a request through the user's web browser in which a valid session already exists.

The following HTML is intended to allow a user to update a profile.

(bad code)

Example Language: HTML

profile.php contains the following code.

(bad code)

Example Language: PHP

// initiate the session in order to validate sessions

session_start();

//if the session is registered to a valid user then allow update

if (! session_is_registered("username")) {

echo "invalid session detected!";

// Redirect user to login page
[...]

exit;

}

// The user session is valid, so process the request

// and update the information

update_profile();

function update_profile {

// read in the data from $POST and send an update

// to the database
SendUpdateToDatabase($_SESSION['username'], $_POST['email']);
[...]
echo "Your profile has been successfully updated.";

}

This code may look protected since it checks for a valid session. However, CSRF attacks can be staged from virtually any tag or HTML construct, including image tags, links, embed or object tags, or other attributes that load background images.

The attacker can then host code that will silently change the username and email address of any user that visits the page while remaining logged in to the target web application. The code might be an innocent-looking web page such as:

(attack code)

Example Language: HTML

<SCRIPT>
function SendAttack () {

form.email = "attacker@example.com";
// send to profile.php
form.submit();

}
</SCRIPT>

<BODY onload="javascript:SendAttack();">

<form action="http://victim.example.com/profile.php" id="form" method="post">
<input type="hidden" name="firstname" value="Funny">
<input type="hidden" name="lastname" value="Joke">
<br/>
<input type="hidden" name="email">
</form>

Notice how the form contains hidden fields, so when it is loaded into the browser, the user will not notice it. Because SendAttack() is defined in the body's onload attribute, it will be automatically called when the victim loads the web page.

Assuming that the user is already logged in to victim.example.com, profile.php will see that a valid user session has been established, then update the email address to the attacker's own address. At this stage, the user's identity has been compromised, and messages sent through this profile could be sent to the attacker's address.

Selected Observed Examples

Reference	Description
CVE-2004-1703	Add user accounts via a URL in an img tag
CVE-2004-1995	Add user accounts via a URL in an img tag
CVE-2004-1967	Arbitrary code execution by specifying the code in a crafted img tag or URL
CVE-2004-1842	Gain administrative privileges via a URL in an img tag
CVE-2005-1947	Delete a victim's information via a URL or an img tag
CVE-2005-2059	Change another user's settings via a URL or an img tag
CVE-2005-1674	Perform actions as administrator via a URL or an img tag
CVE-2009-3520	modify password for the administrator
CVE-2009-3022	CMS allows modification of configuration via CSRF attack against the administrator
CVE-2009-3759	web interface allows password changes or stopping a virtual machine via CSRF

Detection Methods

Method	Details
Manual Analysis	This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Specifically, manual analysis can be useful for finding this weakness, and for minimizing false positives assuming an understanding of business logic. However, it might not achieve desired code coverage within limited time constraints. For black-box analysis, if credentials are not known for privileged accounts, then the most security-critical portions of the application may not receive sufficient attention. Consider using OWASP CSRFTester to identify potential issues and aid in manual analysis. Effectiveness: High Note:These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Automated Static Analysis	CSRF is currently difficult to detect reliably using automated techniques. This is because each application has its own implicit security policy that dictates which requests can be influenced by an outsider and automatically performed on behalf of a user, versus which requests require strong confidence that the user intends to make the request. For example, a keyword search of the public portion of a web site is typically expected to be encoded within a link that can be launched automatically when the user clicks on the link. Effectiveness: Limited
Automated Static Analysis - Binary or Bytecode	According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis Effectiveness: SOAR Partial
Manual Static Analysis - Binary or Bytecode	According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies Effectiveness: SOAR Partial
Dynamic Analysis with Automated Results Interpretation	According to SOAR, the following detection techniques may be useful: Highly cost effective: Web Application Scanner Effectiveness: High
Dynamic Analysis with Manual Results Interpretation	According to SOAR, the following detection techniques may be useful: Highly cost effective: Fuzz Tester Framework-based Fuzzer Effectiveness: High
Manual Static Analysis - Source Code	According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections) Effectiveness: SOAR Partial
Automated Static Analysis - Source Code	According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer Effectiveness: SOAR Partial
Architecture or Design Review	According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction Effectiveness: SOAR Partial

Memberships

Nature	Type	ID	Name
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	635	Weaknesses Originally Used by NVD from 2008 to 2016
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	716	OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	751	2009 Top 25 - Insecure Interaction Between Components
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	801	2010 Top 25 - Insecure Interaction Between Components
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	814	OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	864	2011 Top 25 - Insecure Interaction Between Components
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	884	CWE Cross-section
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	936	OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF)
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1200	Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1337	Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1345	OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1350	Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1387	Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1411	Comprehensive Categorization: Insufficient Verification of Data Authenticity
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1425	Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1430	Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses

Vulnerability Mapping Notes

Usage	ALLOWED (this CWE ID may be used to map to real-world vulnerabilities)
Reason	Other
Rationale	This is a well-known Composite of multiple weaknesses that must all occur simultaneously, although it is attack-oriented in nature.
Comments	While attack-oriented composites are supported in CWE, they have not been a focus of research. There is a chance that future research or CWE scope clarifications will change or deprecate them. Perform root-cause analysis to determine if other weaknesses allow CSRF attacks to occur, and map to those weaknesses. For example, predictable CSRF tokens might allow bypass of CSRF protection mechanisms; if this occurs, they might be better characterized as randomness/predictability weaknesses.

Notes

Relationship

There can be a close relationship between XSS and CSRF (CWE-352). An attacker might use CSRF in order to trick the victim into submitting requests to the server in which the requests contain an XSS payload. A well-known example of this was the Samy worm on MySpace [REF-956]. The worm used XSS to insert malicious HTML sequences into a user's profile and add the attacker as a MySpace friend. MySpace friends of that victim would then execute the payload to modify their own profiles, causing the worm to propagate exponentially. Since the victims did not intentionally insert the malicious script themselves, CSRF was a root cause.

Theoretical

The CSRF topology is multi-channel:

Attacker (as outsider) to intermediary (as user). The interaction point is either an external or internal channel.
Intermediary (as user) to server (as victim). The activation point is an internal channel.

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
PLOVER			Cross-Site Request Forgery (CSRF)
OWASP Top Ten 2007	A5	Exact	Cross Site Request Forgery (CSRF)
WASC	9		Cross-site Request Forgery

Related Attack Patterns

CAPEC-ID	Attack Pattern Name
CAPEC-111	JSON Hijacking (aka JavaScript Hijacking)
CAPEC-462	Cross-Domain Search Timing
CAPEC-467	Cross Site Identification
CAPEC-62	Cross Site Request Forgery

References

[REF-44]	Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security". "Sin 2: Web-Server Related Vulnerabilities (XSS, XSRF, and Response Splitting)." Page 37. McGraw-Hill. 2010.
[REF-329]	Peter W. "Cross-Site Request Forgeries (Re: The Dangers of Allowing Users to Post Images)". Bugtraq. <http://marc.info/?l=bugtraq&m=99263135911884&w=2>.
[REF-330]	OWASP. "Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet". <http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet>.
[REF-331]	Edward W. Felten and William Zeller. "Cross-Site Request Forgeries: Exploitation and Prevention". 2008-10-18. <https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.147.1445>. (URL validated: 2023-04-07)
[REF-332]	Robert Auger. "CSRF - The Cross-Site Request Forgery (CSRF/XSRF) FAQ". <https://www.cgisecurity.com/csrf-faq.html>. (URL validated: 2023-04-07)
[REF-333]	"Cross-site request forgery". Wikipedia. 2008-12-22. <https://en.wikipedia.org/wiki/Cross-site_request_forgery>. (URL validated: 2023-04-07)
[REF-334]	Jason Lam. "Top 25 Series - Rank 4 - Cross Site Request Forgery". SANS Software Security Institute. 2010-03-03. <http://software-security.sans.org/blog/2010/03/03/top-25-series-rank-4-cross-site-request-forgery>.
[REF-335]	Jeff Atwood. "Preventing CSRF and XSRF Attacks". 2008-10-14. <https://blog.codinghorror.com/preventing-csrf-and-xsrf-attacks/>. (URL validated: 2023-04-07)
[REF-45]	OWASP. "OWASP Enterprise Security API (ESAPI) Project". <http://www.owasp.org/index.php/ESAPI>.
[REF-956]	Wikipedia. "Samy (computer worm)". <https://en.wikipedia.org/wiki/Samy_(computer_worm)>. (URL validated: 2018-01-16)

Content History

Submissions
Submission Date	Submitter	Organization
2006-07-19 (CWE Draft 3, 2006-07-19)	PLOVER
2006-07-19 (CWE Draft 3, 2006-07-19)
Contributions
Contribution Date	Contributor	Organization
2024-02-29 (CWE 4.17, 2025-04-03)	Abhi Balakrishnan
2024-02-29 (CWE 4.17, 2025-04-03)	Contributed usability diagram concepts used by the CWE team.
Modifications
Modification Date	Modifier	Organization
2025-04-03 (CWE 4.17, 2025-04-03)	CWE Content Team	MITRE
2025-04-03 (CWE 4.17, 2025-04-03)	updated Alternate_Terms, Common_Consequences, Description, Diagram
2024-11-19 (CWE 4.16, 2024-11-19)	CWE Content Team	MITRE
2024-11-19 (CWE 4.16, 2024-11-19)	updated Relationships
2023-06-29	CWE Content Team	MITRE
2023-06-29	updated Mapping_Notes, Relationships
2023-04-27	CWE Content Team	MITRE
2023-04-27	updated References, Relationships
2022-06-28	CWE Content Team	MITRE
2022-06-28	updated Relationships
2021-10-28	CWE Content Team	MITRE
2021-10-28	updated Relationships
2021-07-20	CWE Content Team	MITRE
2021-07-20	updated Relationships
2020-08-20	CWE Content Team	MITRE
2020-08-20	updated Relationships
2020-06-25	CWE Content Team	MITRE
2020-06-25	updated Relationships, Theoretical_Notes
2020-02-24	CWE Content Team	MITRE
2020-02-24	updated Relationships
2019-09-19	CWE Content Team	MITRE
2019-09-19	updated Relationships
2018-03-27	CWE Content Team	MITRE
2018-03-27	updated References, Relationship_Notes, Research_Gaps
2017-11-08	CWE Content Team	MITRE
2017-11-08	updated Applicable_Platforms, Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships
2015-12-07	CWE Content Team	MITRE
2015-12-07	updated Relationships
2014-07-30	CWE Content Team	MITRE
2014-07-30	updated Detection_Factors
2013-07-17	CWE Content Team	MITRE
2013-07-17	updated References, Relationships
2013-02-21	CWE Content Team	MITRE
2013-02-21	updated Relationships
2012-10-30	CWE Content Team	MITRE
2012-10-30	updated Potential_Mitigations
2012-05-11	CWE Content Team	MITRE
2012-05-11	updated Related_Attack_Patterns, Relationships
2011-09-13	CWE Content Team	MITRE
2011-09-13	updated Potential_Mitigations, References
2011-06-27	CWE Content Team	MITRE
2011-06-27	updated Relationships
2011-06-01	CWE Content Team	MITRE
2011-06-01	updated Common_Consequences
2011-03-29	CWE Content Team	MITRE
2011-03-29	updated Description
2010-09-27	CWE Content Team	MITRE
2010-09-27	updated Potential_Mitigations
2010-06-21	CWE Content Team	MITRE
2010-06-21	updated Common_Consequences, Detection_Factors, Potential_Mitigations, References, Relationships
2010-02-16	CWE Content Team	MITRE
2010-02-16	updated Applicable_Platforms, Detection_Factors, References, Relationships, Taxonomy_Mappings
2009-12-28	CWE Content Team	MITRE
2009-12-28	updated Common_Consequences, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Observed_Examples, Potential_Mitigations, Time_of_Introduction
2009-05-27	CWE Content Team	MITRE
2009-05-27	updated Demonstrative_Examples, Related_Attack_Patterns
2009-05-20	Tom Stracener
2009-05-20	Added demonstrative example for profile.
2009-03-10	CWE Content Team	MITRE
2009-03-10	updated Potential_Mitigations
2009-01-12	CWE Content Team	MITRE
2009-01-12	updated Applicable_Platforms, Description, Likelihood_of_Exploit, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationship_Notes, Relationships, Research_Gaps, Theoretical_Notes
2008-09-08	CWE Content Team	MITRE
2008-09-08	updated Alternate_Terms, Description, Relationships, Other_Notes, Relationship_Notes, Taxonomy_Mappings
2008-07-01	Eric Dalci	Cigital
2008-07-01	updated Time_of_Introduction

Weakness ID: 200

Vulnerability Mapping: DISCOURAGED This CWE ID should not be used to map to real-world vulnerabilities
Abstraction: Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.

View customized information:

Description

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Extended Description

There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include:

private, personal information, such as personal messages, financial data, health records, geographic location, or contact details
system status and environment, such as the operating system and installed packages
business secrets and intellectual property
network status and configuration
the product's own code or internal state
metadata, e.g. logging of connections or message headers
indirect information, such as a discrepancy between two internal operations that can be observed by an outsider

Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include:

the product's own users
people or organizations whose information is created or used by the product, even if they are not direct product users
the product's administrators, including the admins of the system(s) and/or networks on which the product operates
the developer

Information exposures can occur in different ways:

the code explicitly inserts sensitive information into resources or messages that are intentionally made accessible to unauthorized actors, but should not contain the information - i.e., the information should have been "scrubbed" or "sanitized"
a different weakness or mistake indirectly inserts the sensitive information into resources, such as a web script error revealing the full system path of the program.
the code manages resources that intentionally contain sensitive information, but the resources are unintentionally made accessible to unauthorized actors. In this case, the information exposure is resultant - i.e., a different weakness enabled the access to the information in the first place.

It is common practice to describe any loss of confidentiality as an "information exposure," but this can lead to overuse of CWE-200 in CWE mapping. From the CWE perspective, loss of confidentiality is a technical impact that can arise from dozens of different weaknesses, such as insecure file permissions or out-of-bounds read. CWE-200 and its lower-level descendants are intended to cover the mistakes that occur in behaviors that explicitly manage, store, transfer, or cleanse sensitive information.

Alternate Terms

Information Disclosure

This term is frequently used in vulnerability advisories to describe a consequence or technical impact, for any vulnerability that has a loss of confidentiality. Often, CWE-200 can be misused to represent the loss of confidentiality, even when the mistake - i.e., the weakness - is not directly related to the mishandling of the information itself, such as an out-of-bounds read that accesses sensitive memory contents; here, the out-of-bounds read is the primary weakness, not the disclosure of the memory. In addition, this phrase is also used frequently in policies and legal documents, but it does not refer to any disclosure of security-relevant information.

Information Leak

This is a frequently used term, however the "leak" term has multiple uses within security. In some cases it deals with the accidental exposure of information from a different weakness, but in other cases (such as "memory leak"), this deals with improper tracking of resources, which can lead to exhaustion. As a result, CWE is actively avoiding usage of the "leak" term.

Common Consequences

Impact	Details
Read Application Data	Scope: Confidentiality

Potential Mitigations

Phase(s)

Mitigation

Architecture and Design

Strategy: Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Relationships

Relevant to the view "Research Concepts" (View-1000)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	668	Exposure of Resource to Wrong Sphere
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	201	Insertion of Sensitive Information Into Sent Data
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	203	Observable Discrepancy
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	209	Generation of Error Message Containing Sensitive Information
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	213	Exposure of Sensitive Information Due to Incompatible Policies
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	215	Insertion of Sensitive Information Into Debugging Code
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	359	Exposure of Private Personal Information to an Unauthorized Actor
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	497	Exposure of Sensitive System Information to an Unauthorized Control Sphere
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	538	Insertion of Sensitive Information into Externally-Accessible File or Directory
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1258	Exposure of Sensitive System Information Due to Uncleared Debug Information
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1273	Device Unlock Credential Sharing
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1295	Debug Messages Revealing Unnecessary Information
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1431	Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
CanFollow	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	498	Cloneable Class Containing Sensitive Information
CanFollow	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	499	Serializable Class Containing Sensitive Data
CanFollow	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1272	Sensitive Information Uncleared Before Debug/Power State Transition

Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (View-1003)

Nature	Type	ID	Name
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1003	Weaknesses for Simplified Mapping of Published Vulnerabilities
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	203	Observable Discrepancy
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	209	Generation of Error Message Containing Sensitive Information
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	532	Insertion of Sensitive Information into Log File

Modes Of Introduction

Phase	Note
Architecture and Design
Implementation

Applicable Platforms

Languages	Class: Not Language-Specific (Undetermined Prevalence)
Technologies	Class: Mobile (Undetermined Prevalence)

Likelihood Of Exploit

High

Demonstrative Examples

Example 1

The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.

(bad code)

Example Language: Perl

my $username=param('username');
my $password=param('password');

if (IsValidUsername($username) == 1)
{

if (IsValidPassword($username, $password) == 1)
{

print "Login Successful";

}
else
{

print "Login Failed - incorrect password";

}

}
else
{

print "Login Failed - unknown username";

}

In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.

While this type of information may be helpful to a user, it is also useful to a potential attacker. In the above example, the message for both failed cases should be the same, such as:

(result)

"Login Failed - incorrect username or password"

Example 2

This code tries to open a database connection, and prints any exceptions that occur.

(bad code)

Example Language: PHP

try {

openDbConnection();

}
//print exception message that includes exception message and configuration file location
catch (Exception $e) {

echo 'Caught exception: ', $e->getMessage(), '\n';
echo 'Check credentials in config file at: ', $Mysql_config_location, '\n';

}

If an exception occurs, the printed message exposes the location of the configuration file the script is using. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the file can be read, the attacker could gain credentials for accessing the database. The attacker may also be able to replace the file with a malicious one, causing the application to use an arbitrary database.

Example 3

In the example below, the method getUserBankAccount retrieves a bank account object from a database using the supplied username and account number to query the database. If an SQLException is raised when querying the database, an error message is created and output to a log file.

(bad code)

Example Language: Java

public BankAccount getUserBankAccount(String username, String accountNumber) {

BankAccount userAccount = null;
String query = null;
try {

if (isAuthorizedUser(username)) {

query = "SELECT * FROM accounts WHERE owner = "
+ username + " AND accountID = " + accountNumber;
DatabaseManager dbManager = new DatabaseManager();
Connection conn = dbManager.getConnection();
Statement stmt = conn.createStatement();
ResultSet queryResult = stmt.executeQuery(query);
userAccount = (BankAccount)queryResult.getObject(accountNumber);

}

} catch (SQLException ex) {

String logMessage = "Unable to retrieve account information from database,\nquery: " + query;
Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);

}
return userAccount;

}

The error message that is created includes information about the database query that may contain sensitive information about the database or query logic. In this case, the error message will expose the table name and column names used in the database. This data could be used to simplify other attacks, such as SQL injection (CWE-89) to directly access the database.

Example 4

This code stores location information about the current user:

(bad code)

Example Language: Java

locationClient = new LocationClient(this, this, this);
locationClient.connect();
currentUser.setLocation(locationClient.getLastLocation());
...

catch (Exception e) {

AlertDialog.Builder builder = new AlertDialog.Builder(this);
builder.setMessage("Sorry, this application has experienced an error.");
AlertDialog alert = builder.create();
alert.show();
Log.e("ExampleActivity", "Caught exception: " + e + " While on User:" + User.toString());

}

When the application encounters an exception it will write the user object to the log. Because the user object contains location information, the user's location is also written to the log.

Example 5

The following is an actual MySQL error statement:

(result)

Example Language: SQL

Warning: mysql_pconnect(): Access denied for user: 'root@localhost' (Using password: N1nj4) in /usr/local/www/wi-data/includes/database.inc on line 4

The error clearly exposes the database credentials.

Example 6

This code displays some information on a web page.

(bad code)

Example Language: JSP

Social Security Number: <%= ssn %></br>Credit Card Number: <%= ccn %>

The code displays a user's credit card and social security numbers, even though they aren't absolutely necessary.

Example 7

The following program changes its behavior based on a debug flag.

(bad code)

Example Language: JSP

<% if (Boolean.getBoolean("debugEnabled")) {

%>
User account number: <%= acctNo %>
<%
} %>

The code writes sensitive debug information to the client browser if the "debugEnabled" flag is set to true .

Example 8

This code uses location to determine the user's current US State location.

First the application must declare that it requires the ACCESS_FINE_LOCATION permission in the application's manifest.xml:

(bad code)

Example Language: XML

<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>

During execution, a call to getLastLocation() will return a location based on the application's location permissions. In this case the application has permission for the most accurate location possible:

(bad code)

Example Language: Java

locationClient = new LocationClient(this, this, this);
locationClient.connect();
Location userCurrLocation;
userCurrLocation = locationClient.getLastLocation();
deriveStateFromCoords(userCurrLocation);

While the application needs this information, it does not need to use the ACCESS_FINE_LOCATION permission, as the ACCESS_COARSE_LOCATION permission will be sufficient to identify which US state the user is in.

Selected Observed Examples

Reference	Description
CVE-2022-31162	Rust library leaks Oauth client details in application debug logs
CVE-2021-25476	Digital Rights Management (DRM) capability for mobile platform leaks pointer information, simplifying ASLR bypass
CVE-2001-1483	Enumeration of valid usernames based on inconsistent responses
CVE-2001-1528	Account number enumeration via inconsistent responses.
CVE-2004-2150	User enumeration via discrepancies in error messages.
CVE-2005-1205	Telnet protocol allows servers to obtain sensitive environment information from clients.
CVE-2002-1725	Script calls phpinfo(), revealing system configuration to web user
CVE-2002-0515	Product sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attackers to identify filtered ports by comparing TTLs.
CVE-2004-0778	Version control system allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned.
CVE-2000-1117	Virtual machine allows malicious web site operators to determine the existence of files on the client by measuring delays in the execution of the getSystemResource method.
CVE-2003-0190	Product immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
CVE-2008-2049	POP3 server reveals a password in an error message after multiple APOP commands are sent. Might be resultant from another weakness.
CVE-2007-5172	Program reveals password in error message if attacker can trigger certain database errors.
CVE-2008-4638	Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).
CVE-2007-1409	Direct request to library file in web application triggers pathname leak in error message.
CVE-2005-0603	Malformed regexp syntax leads to information exposure in error message.
CVE-2004-2268	Password exposed in debug information.
CVE-2003-1078	FTP client with debug option enabled shows password to the screen.
CVE-2022-0708	Collaboration platform does not clear team emails in a response, allowing leak of email addresses

Weakness Ordinalities

Ordinality	Description
Primary	(where the weakness exists independent of other weaknesses) Developers may insert sensitive information that they do not believe, or they might forget to remove the sensitive information after it has been processed
Resultant	(where the weakness is typically related to the presence of some other weaknesses) Separate mistakes or weaknesses could inadvertently make the sensitive information available to an attacker, such as in a detailed error message that can be read by an unauthorized party

Detection Methods

Method	Details
Automated Static Analysis - Binary or Bytecode	According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Inter-application Flow Analysis Effectiveness: SOAR Partial
Dynamic Analysis with Automated Results Interpretation	According to SOAR, the following detection techniques may be useful: Highly cost effective: Web Application Scanner Web Services Scanner Database Scanners Effectiveness: High
Dynamic Analysis with Manual Results Interpretation	According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer Automated Monitored Execution Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious Effectiveness: SOAR Partial
Manual Static Analysis - Source Code	According to SOAR, the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Effectiveness: High
Automated Static Analysis - Source Code	According to SOAR, the following detection techniques may be useful: Highly cost effective: Context-configured Source Code Weakness Analyzer Cost effective for partial coverage: Source code Weakness Analyzer Effectiveness: High
Architecture or Design Review	According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Attack Modeling Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Effectiveness: High

Memberships

Nature	Type	ID	Name
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	635	Weaknesses Originally Used by NVD from 2008 to 2016
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	717	OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	963	SFP Secondary Cluster: Exposed Data
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1200	Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1337	Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1345	OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1350	Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1417	Comprehensive Categorization: Sensitive Information Exposure
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1430	Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses

Vulnerability Mapping Notes

Usage	DISCOURAGED (this CWE ID should not be used to map to real-world vulnerabilities)
Reason	Frequent Misuse
Rationale	CWE-200 is commonly misused to represent the loss of confidentiality in a vulnerability, but confidentiality loss is a technical impact - not a root cause error. As of CWE 4.9, over 400 CWE entries can lead to a loss of confidentiality. Other options are often available. [REF-1287].
Comments	If an error or mistake causes information to be disclosed, then use the CWE ID for that error. Consider starting with improper authorization (CWE-285), insecure permissions (CWE-732), improper authentication (CWE-287), etc. Also consider children such as Insertion of Sensitive Information Into Sent Data (CWE-201), Observable Discrepancy (CWE-203), Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538), or others.

Notes

Maintenance

As a result of mapping analysis in the 2020 Top 25 and more recent versions, this weakness is under review, since it is frequently misused in mapping to cover many problems that lead to loss of confidentiality. See Mapping Notes, Extended Description, and Alternate Terms.

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
PLOVER			Information Leak (information disclosure)
OWASP Top Ten 2007	A6	CWE More Specific	Information Leakage and Improper Error Handling
WASC	13		Information Leakage

Related Attack Patterns

CAPEC-ID	Attack Pattern Name
CAPEC-116	Excavation
CAPEC-13	Subverting Environment Variable Values
CAPEC-169	Footprinting
CAPEC-22	Exploiting Trust in Client
CAPEC-224	Fingerprinting
CAPEC-285	ICMP Echo Request Ping
CAPEC-287	TCP SYN Scan
CAPEC-290	Enumerate Mail Exchange (MX) Records
CAPEC-291	DNS Zone Transfers
CAPEC-292	Host Discovery
CAPEC-293	Traceroute Route Enumeration
CAPEC-294	ICMP Address Mask Request
CAPEC-295	Timestamp Request
CAPEC-296	ICMP Information Request
CAPEC-297	TCP ACK Ping
CAPEC-298	UDP Ping
CAPEC-299	TCP SYN Ping
CAPEC-300	Port Scanning
CAPEC-301	TCP Connect Scan
CAPEC-302	TCP FIN Scan
CAPEC-303	TCP Xmas Scan
CAPEC-304	TCP Null Scan
CAPEC-305	TCP ACK Scan
CAPEC-306	TCP Window Scan
CAPEC-307	TCP RPC Scan
CAPEC-308	UDP Scan
CAPEC-309	Network Topology Mapping
CAPEC-310	Scanning for Vulnerable Software
CAPEC-312	Active OS Fingerprinting
CAPEC-313	Passive OS Fingerprinting
CAPEC-317	IP ID Sequencing Probe
CAPEC-318	IP 'ID' Echoed Byte-Order Probe
CAPEC-319	IP (DF) 'Don't Fragment Bit' Echoing Probe
CAPEC-320	TCP Timestamp Probe
CAPEC-321	TCP Sequence Number Probe
CAPEC-322	TCP (ISN) Greatest Common Divisor Probe
CAPEC-323	TCP (ISN) Counter Rate Probe
CAPEC-324	TCP (ISN) Sequence Predictability Probe
CAPEC-325	TCP Congestion Control Flag (ECN) Probe
CAPEC-326	TCP Initial Window Size Probe
CAPEC-327	TCP Options Probe
CAPEC-328	TCP 'RST' Flag Checksum Probe
CAPEC-329	ICMP Error Message Quoting Probe
CAPEC-330	ICMP Error Message Echoing Integrity Probe
CAPEC-472	Browser Fingerprinting
CAPEC-497	File Discovery
CAPEC-508	Shoulder Surfing
CAPEC-573	Process Footprinting
CAPEC-574	Services Footprinting
CAPEC-575	Account Footprinting
CAPEC-576	Group Permission Footprinting
CAPEC-577	Owner Footprinting
CAPEC-59	Session Credential Falsification through Prediction
CAPEC-60	Reusing Session IDs (aka Session Replay)
CAPEC-616	Establish Rogue Location
CAPEC-643	Identify Shared Files/Directories on System
CAPEC-646	Peripheral Footprinting
CAPEC-651	Eavesdropping
CAPEC-79	Using Slashes in Alternate Encoding

References

[REF-172]	Chris Wysopal. "Mobile App Top 10 List". 2010-12-13. <https://www.veracode.com/blog/2010/12/mobile-app-top-10-list>. (URL validated: 2023-04-07)
[REF-1287]	MITRE. "Supplemental Details - 2022 CWE Top 25". Details of Problematic Mappings. 2022-06-28. <https://cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails>. (URL validated: 2024-11-17)

Content History

Submissions
Submission Date	Submitter	Organization
2006-07-19 (CWE Draft 3, 2006-07-19)	PLOVER
2006-07-19 (CWE Draft 3, 2006-07-19)
Contributions
Contribution Date	Contributor	Organization
2022-07-11	Nick Johnston
2022-07-11	Identified incorrect language tag in demonstrative example.
Modifications
Modification Date	Modifier	Organization
2025-04-03 (CWE 4.17, 2025-04-03)	CWE Content Team	MITRE
2025-04-03 (CWE 4.17, 2025-04-03)	updated Relationships
2024-11-19 (CWE 4.16, 2024-11-19)	CWE Content Team	MITRE
2024-11-19 (CWE 4.16, 2024-11-19)	updated Relationships
2023-10-26	CWE Content Team	MITRE
2023-10-26	updated Observed_Examples
2023-06-29	CWE Content Team	MITRE
2023-06-29	updated Mapping_Notes
2023-04-27	CWE Content Team	MITRE
2023-04-27	updated References, Relationships
2022-10-13	CWE Content Team	MITRE
2022-10-13	updated Demonstrative_Examples, Maintenance_Notes, Observed_Examples, References
2021-10-28	CWE Content Team	MITRE
2021-10-28	updated Relationships
2021-07-20	CWE Content Team	MITRE
2021-07-20	updated Relationships
2020-12-10	CWE Content Team	MITRE
2020-12-10	updated Potential_Mitigations
2020-08-20	CWE Content Team	MITRE
2020-08-20	updated Alternate_Terms, Description, Maintenance_Notes, Related_Attack_Patterns, Relationships
2020-06-25	CWE Content Team	MITRE
2020-06-25	updated Relationships
2020-02-24	CWE Content Team	MITRE
2020-02-24	updated Applicable_Platforms, Demonstrative_Examples, Description, Name, Observed_Examples, Related_Attack_Patterns, Relationships, Weakness_Ordinalities
2019-09-19	CWE Content Team	MITRE
2019-09-19	updated Demonstrative_Examples, Observed_Examples, Relationships
2019-06-20	CWE Content Team	MITRE
2019-06-20	updated Related_Attack_Patterns, Relationships
2019-01-03	CWE Content Team	MITRE
2019-01-03	updated Related_Attack_Patterns
2017-11-08	CWE Content Team	MITRE
2017-11-08	updated References
2017-05-03	CWE Content Team	MITRE
2017-05-03	updated Related_Attack_Patterns
2015-12-07	CWE Content Team	MITRE
2015-12-07	updated Relationships
2014-07-30	CWE Content Team	MITRE
2014-07-30	updated Detection_Factors, Relationships
2014-06-23	CWE Content Team	MITRE
2014-06-23	updated Related_Attack_Patterns
2013-02-21	CWE Content Team	MITRE
2013-02-21	updated Alternate_Terms, Applicable_Platforms, References
2012-10-30	CWE Content Team	MITRE
2012-10-30	updated Potential_Mitigations
2012-05-11	CWE Content Team	MITRE
2012-05-11	updated Related_Attack_Patterns, Relationships
2011-06-01	CWE Content Team	MITRE
2011-06-01	updated Common_Consequences
2011-03-29	CWE Content Team	MITRE
2011-03-29	updated Description, Relationships
2010-04-05	CWE Content Team	MITRE
2010-04-05	updated Related_Attack_Patterns
2010-02-16	CWE Content Team	MITRE
2010-02-16	updated Taxonomy_Mappings
2009-12-28	CWE Content Team	MITRE
2009-12-28	updated Alternate_Terms, Description, Name
2008-10-14	CWE Content Team	MITRE
2008-10-14	updated Description
2008-09-08	CWE Content Team	MITRE
2008-09-08	updated Likelihood_of_Exploit, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
2008-07-01	Eric Dalci	Cigital
2008-07-01	updated Time_of_Introduction
Previous Entry Names
Change Date	Previous Entry Name
2009-12-28	Information Leak (Information Disclosure)
2020-02-24	Information Exposure

Weakness ID: 209

View customized information:

Description

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Extended Description

The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks. The error message may be created in different ways:

self-generated: the source code explicitly constructs the error message and delivers it
externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer

An attacker may use the contents of error messages to help launch another, more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.

Common Consequences

Impact	Details
Read Application Data	Scope: Confidentiality Often this will either reveal sensitive information which may be used for a later attack or private information stored in the server.

Potential Mitigations

Phase(s)	Mitigation
Implementation	Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Implementation	Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Implementation	Strategy: Attack Surface Reduction Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible. Effectiveness: Defense in Depth Note: This makes it easier to spot places in the code where data is being used that is unencrypted.
Implementation; Build and Compilation	Strategy: Compilation or Build Hardening Debugging information should not make its way into a production release.
Implementation; Build and Compilation	Strategy: Environment Hardening Debugging information should not make its way into a production release.
System Configuration	Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
System Configuration	Create default error pages or messages that do not leak any information.

Relationships

Relevant to the view "Research Concepts" (View-1000)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	200	Exposure of Sensitive Information to an Unauthorized Actor
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	755	Improper Handling of Exceptional Conditions
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	210	Self-generated Error Message Containing Sensitive Information
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	211	Externally-Generated Error Message Containing Sensitive Information
ParentOf	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	550	Server-generated Error Message Containing Sensitive Information
PeerOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1295	Debug Messages Revealing Unnecessary Information
CanFollow	Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	600	Uncaught Exception in Servlet
CanFollow	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	756	Missing Custom Error Page

Relevant to the view "Software Development" (View-699)

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	199	Information Management Errors
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	389	Error Conditions, Return Values, Status Codes

Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (View-1003)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	200	Exposure of Sensitive Information to an Unauthorized Actor

Relevant to the view "Architectural Concepts" (View-1008)

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1015	Limit Access

Modes Of Introduction

Phase	Note
Architecture and Design
Implementation	REALIZATION: This weakness is caused during implementation of an architectural security tactic.
System Configuration
Operation

Applicable Platforms

Languages

PHP (Often Prevalent)

Java (Often Prevalent)

Class: Not Language-Specific (Undetermined Prevalence)

Likelihood Of Exploit

High

Demonstrative Examples

Example 1

In the following example, sensitive information might be printed depending on the exception that occurs.

(bad code)

Example Language: Java

try {

/.../

}
catch (Exception e) {

System.out.println(e);

}

If an exception related to SQL is handled by the catch, then the output might contain sensitive information such as SQL query structure or private information. If this output is redirected to a web user, this may represent a security problem.

Example 2

This code tries to open a database connection, and prints any exceptions that occur.

(bad code)

Example Language: PHP

try {

openDbConnection();

}
//print exception message that includes exception message and configuration file location
catch (Exception $e) {

echo 'Caught exception: ', $e->getMessage(), '\n';
echo 'Check credentials in config file at: ', $Mysql_config_location, '\n';

}

Example 3

The following code generates an error message that leaks the full pathname of the configuration file.

(bad code)

Example Language: Perl

$ConfigDir = "/home/myprog/config";
$uname = GetUserInput("username");

# avoid CWE-22, CWE-78, others.
ExitError("Bad hacker!") if ($uname !~ /^\w+$/);
$file = "$ConfigDir/$uname.txt";
if (! (-e $file)) {

ExitError("Error: $file does not exist");

}
...

If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that does not produce a $file that exists, an attacker could get this pathname. It could then be used to exploit path traversal or symbolic link following problems that may exist elsewhere in the application.

Example 4

(bad code)

Example Language: Java

public BankAccount getUserBankAccount(String username, String accountNumber) {

BankAccount userAccount = null;
String query = null;
try {

if (isAuthorizedUser(username)) {

}

} catch (SQLException ex) {

String logMessage = "Unable to retrieve account information from database,\nquery: " + query;
Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);

}
return userAccount;

}

Selected Observed Examples

Reference	Description
CVE-2008-2049	POP3 server reveals a password in an error message after multiple APOP commands are sent. Might be resultant from another weakness.
CVE-2007-5172	Program reveals password in error message if attacker can trigger certain database errors.
CVE-2008-4638	Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).
CVE-2008-1579	Existence of user names can be determined by requesting a nonexistent blog and reading the error message.
CVE-2007-1409	Direct request to library file in web application triggers pathname leak in error message.
CVE-2008-3060	Malformed input to login page causes leak of full path when IMAP call fails.
CVE-2005-0603	Malformed regexp syntax leads to information exposure in error message.
CVE-2017-9615	verbose logging stores admin credentials in a world-readablelog file
CVE-2018-1999036	SSH password for private key stored in build log

Weakness Ordinalities

Ordinality	Description
Primary	(where the weakness exists independent of other weaknesses)
Resultant	(where the weakness is typically related to the presence of some other weaknesses)

Detection Methods

Method	Details
Manual Analysis	This weakness generally requires domain-specific interpretation using manual analysis. However, the number of potential error conditions may be too large to cover completely within limited time constraints. Effectiveness: High
Automated Analysis	Automated methods may be able to detect certain idioms automatically, such as exposed stack traces or pathnames, but violation of business rules or privacy requirements is not typically feasible. Effectiveness: Moderate
Automated Dynamic Analysis	This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results. Error conditions may be triggered with a stress-test by calling the software simultaneously from a large number of threads or processes, and look for evidence of any unexpected behavior. Effectiveness: Moderate
Manual Dynamic Analysis	Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the program under low memory conditions, run with insufficient privileges or permissions, interrupt a transaction before it is completed, or disable connectivity to basic network services such as DNS. Monitor the software for any unexpected behavior. If you trigger an unhandled exception or similar error that was discovered and handled by the application's environment, it may still indicate unexpected conditions that were not handled by the application itself.
Automated Static Analysis	Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Memberships

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	717	OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	728	OWASP Top Ten 2004 Category A7 - Improper Error Handling
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	731	OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	751	2009 Top 25 - Insecure Interaction Between Components
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	801	2010 Top 25 - Insecure Interaction Between Components
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	815	OWASP Top Ten 2010 Category A6 - Security Misconfiguration
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	851	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	867	2011 Top 25 - Weaknesses On the Cusp
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	880	CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	884	CWE Cross-section
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	933	OWASP Top Ten 2013 Category A5 - Security Misconfiguration
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	963	SFP Secondary Cluster: Exposed Data
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1032	OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1348	OWASP Top Ten 2021 Category A04:2021 - Insecure Design
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1417	Comprehensive Categorization: Sensitive Information Exposure

Vulnerability Mapping Notes

Usage	ALLOWED (this CWE ID may be used to map to real-world vulnerabilities)
Reason	Acceptable-Use
Rationale	This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comments	Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
CLASP			Accidental leaking of sensitive information through error messages
OWASP Top Ten 2007	A6	CWE More Specific	Information Leakage and Improper Error Handling
OWASP Top Ten 2004	A7	CWE More Specific	Improper Error Handling
OWASP Top Ten 2004	A10	CWE More Specific	Insecure Configuration Management
The CERT Oracle Secure Coding Standard for Java (2011)	ERR01-J		Do not allow exceptions to expose sensitive information
Software Fault Patterns	SFP23		Exposed Data

Related Attack Patterns

CAPEC-ID	Attack Pattern Name
CAPEC-215	Fuzzing for application mapping
CAPEC-463	Padding Oracle Crypto Attack
CAPEC-54	Query System for Information
CAPEC-7	Blind SQL Injection

References

[REF-174]	Web Application Security Consortium. "Information Leakage". <http://projects.webappsec.org/w/page/13246936/Information%20Leakage>. (URL validated: 2023-04-07)
[REF-175]	Brian Chess and Jacob West. "Secure Programming with Static Analysis". Section 9.2, Page 326. Addison-Wesley. 2007.
[REF-176]	Michael Howard and David LeBlanc. "Writing Secure Code". Chapter 16, "General Good Practices." Page 415. 1st Edition. Microsoft Press. 2001-11-13.
[REF-44]	Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security". "Sin 11: Failure to Handle Errors Correctly." Page 183. McGraw-Hill. 2010.
[REF-44]	Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security". "Sin 12: Information Leakage." Page 191. McGraw-Hill. 2010.
[REF-179]	Johannes Ullrich. "Top 25 Series - Rank 16 - Information Exposure Through an Error Message". SANS Software Security Institute. 2010-03-17. <http://software-security.sans.org/blog/2010/03/17/top-25-series-rank-16-information-exposure-through-an-error-message>.
[REF-62]	Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security Assessment". Chapter 3, "Overly Verbose Error Messages", Page 75. 1st Edition. Addison Wesley. 2006.
[REF-18]	Secure Software, Inc.. "The CLASP Application Security Process". 2005. <https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf>. (URL validated: 2024-11-17)

Content History

Submissions
Submission Date	Submitter	Organization
2006-07-19 (CWE Draft 3, 2006-07-19)	CLASP
2006-07-19 (CWE Draft 3, 2006-07-19)
Contributions
Contribution Date	Contributor	Organization
2022-07-11	Nick Johnston
2022-07-11	Identified incorrect language tag in demonstrative example.
Modifications
Modification Date	Modifier	Organization
2023-06-29	CWE Content Team	MITRE
2023-06-29	updated Mapping_Notes
2023-04-27	CWE Content Team	MITRE
2023-04-27	updated Detection_Factors, References, Relationships
2023-01-31	CWE Content Team	MITRE
2023-01-31	updated Description
2022-10-13	CWE Content Team	MITRE
2022-10-13	updated Demonstrative_Examples
2021-10-28	CWE Content Team	MITRE
2021-10-28	updated Relationships
2021-07-20	CWE Content Team	MITRE
2021-07-20	updated Relationships
2020-12-10	CWE Content Team	MITRE
2020-12-10	updated Potential_Mitigations, Related_Attack_Patterns
2020-02-24	CWE Content Team	MITRE
2020-02-24	updated Applicable_Platforms, Description, Name, Observed_Examples, References, Relationships, Weakness_Ordinalities
2019-09-19	CWE Content Team	MITRE
2019-09-19	updated Demonstrative_Examples, Observed_Examples
2019-06-20	CWE Content Team	MITRE
2019-06-20	updated Relationships
2019-01-03	CWE Content Team	MITRE
2019-01-03	updated Taxonomy_Mappings
2018-03-27	CWE Content Team	MITRE
2018-03-27	updated References, Relationships
2017-11-08	CWE Content Team	MITRE
2017-11-08	updated Applicable_Platforms, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
2014-07-30	CWE Content Team	MITRE
2014-07-30	updated Relationships, Taxonomy_Mappings
2014-06-23	CWE Content Team	MITRE
2014-06-23	updated Relationships
2013-07-17	CWE Content Team	MITRE
2013-07-17	updated References
2012-05-11	CWE Content Team	MITRE
2012-05-11	updated References, Related_Attack_Patterns, Relationships
2011-09-13	CWE Content Team	MITRE
2011-09-13	updated Relationships, Taxonomy_Mappings
2011-06-27	CWE Content Team	MITRE
2011-06-27	updated Relationships
2011-06-01	CWE Content Team	MITRE
2011-06-01	updated Relationships, Taxonomy_Mappings
2011-03-29	CWE Content Team	MITRE
2011-03-29	updated Demonstrative_Examples, Observed_Examples, Relationships
2010-09-27	CWE Content Team	MITRE
2010-09-27	updated Potential_Mitigations, Relationships
2010-09-09		Veracode
2010-09-09	Suggested OWASP Top Ten mapping
2010-06-21	CWE Content Team	MITRE
2010-06-21	updated Common_Consequences, Detection_Factors, Potential_Mitigations, References
2010-04-05	CWE Content Team	MITRE
2010-04-05	updated Related_Attack_Patterns
2010-02-16	CWE Content Team	MITRE
2010-02-16	updated Detection_Factors, References, Relationships
2009-12-28	CWE Content Team	MITRE
2009-12-28	updated Demonstrative_Examples, Name, Potential_Mitigations, References, Time_of_Introduction
2009-03-10	CWE Content Team	MITRE
2009-03-10	updated Demonstrative_Examples, Potential_Mitigations, Relationships
2009-01-12	CWE Content Team	MITRE
2009-01-12	updated Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Time_of_Introduction
2008-10-14	CWE Content Team	MITRE
2008-10-14	updated Relationships
2008-09-08	CWE Content Team	MITRE
2008-09-08	updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
2008-08-15		Veracode
2008-08-15	Suggested OWASP Top Ten 2004 mapping
2008-07-01	Eric Dalci	Cigital
2008-07-01	updated Time_of_Introduction
Previous Entry Names
Change Date	Previous Entry Name
2009-01-12	Error Message Information Leaks
2009-12-28	Error Message Information Leak
2020-02-24	Information Exposure Through an Error Message

Weakness ID: 284

Vulnerability Mapping: DISCOURAGED This CWE ID should not be used to map to real-world vulnerabilities
Abstraction: Pillar Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.

View customized information:

Description

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Extended Description

Access control involves the use of several protection mechanisms such as:

Authentication (proving the identity of an actor)
Authorization (ensuring that a given actor can access a resource), and
Accountability (tracking of activities that were performed)

When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.

There are two distinct behaviors that can introduce access control weaknesses:

Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.

Alternate Terms

Authorization

The terms "access control" and "authorization" are often used interchangeably, although many people have distinct definitions. The CWE usage of "access control" is intended as a general term for the various mechanisms that restrict which users can access which resources, and "authorization" is more narrowly defined. It is unlikely that there will be community consensus on the use of these terms.

Common Consequences

Impact	Details
Varies by Context	Scope: Other

Potential Mitigations

Phase(s)

Mitigation

Architecture and Design; Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design

Strategy: Separation of Privilege

Relationships

Relevant to the view "Research Concepts" (View-1000)

Nature	Type	ID	Name
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1000	Research Concepts
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	269	Improper Privilege Management
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	282	Improper Ownership Management
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	285	Improper Authorization
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	286	Incorrect User Management
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	287	Improper Authentication
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	346	Origin Validation Error
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	749	Exposed Dangerous Method or Function
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	923	Improper Restriction of Communication Channel to Intended Endpoints
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1191	On-Chip Debug and Test Interface With Improper Access Control
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1220	Insufficient Granularity of Access Control
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1224	Improper Restriction of Write-Once Bit Fields
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1231	Improper Prevention of Lock Bit Modification
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1233	Security-Sensitive Hardware Controls with Missing Lock Bit Protection
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1252	CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1257	Improper Access Control Applied to Mirrored or Aliased Memory Regions
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1259	Improper Restriction of Security Token Assignment
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1260	Improper Handling of Overlap Between Protected Memory Ranges
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1262	Improper Access Control for Register Interface
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	1263	Improper Physical Access Control
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1267	Policy Uses Obsolete Encoding
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1268	Policy Privileges are not Assigned Consistently Between Control and Data Agents
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1270	Generation of Incorrect Security Tokens
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1274	Improper Access Control for Volatile Memory Containing Boot Code
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1276	Hardware Child Block Incorrectly Connected to Parent System
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1280	Access Control Check Implemented After Asset is Accessed
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1283	Mutable Attestation or Measurement Reporting Data
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1290	Incorrect Decoding of Security Identifiers
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1292	Incorrect Conversion of Security Identifiers
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	1294	Insecure Security Identifier Mechanism
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1296	Incorrect Chaining or Granularity of Debug Components
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1304	Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1311	Improper Translation of Security Attributes by Fabric Bridge
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1312	Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1313	Hardware Allows Activation of Test or Debug Logic at Runtime
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1315	Improper Setting of Bus Controlling Capability in Fabric End-point
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1316	Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1317	Improper Access Control in Fabric Bridge
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1320	Improper Protection for Outbound Error Messages and Alert Signals
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1323	Improper Management of Sensitive Trace Data
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	1334	Unauthorized Error Injection Can Degrade Hardware Redundancy

Relevant to the view "Architectural Concepts" (View-1008)

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1011	Authorize Actors

Relevant to the view "CISQ Data Protection Measures" (View-1340)

Nature	Type	ID	Name
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	285	Improper Authorization
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	287	Improper Authentication
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	288	Authentication Bypass Using an Alternate Path or Channel
ParentOf	Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	639	Authorization Bypass Through User-Controlled Key
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	862	Missing Authorization
ParentOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	863	Incorrect Authorization

Modes Of Introduction

Phase	Note
Architecture and Design
Implementation	REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation

Applicable Platforms

Technologies

Class: Not Technology-Specific (Undetermined Prevalence)

Class: ICS/OT (Undetermined Prevalence)

Selected Observed Examples

Reference	Description
CVE-2022-24985	A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms
CVE-2022-29238	Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
CVE-2022-23607	Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect
CVE-2021-21972	Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
CVE-2021-37415	IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.
CVE-2021-35033	Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port
CVE-2020-10263	Bluetooth speaker does not require authentication for the debug functionality on the UART port, allowing root shell access
CVE-2020-13927	Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.
CVE-2010-4624	Bulletin board applies restrictions on number of images during post creation, but does not enforce this on editing.

Affected Resources

File or Directory

Memberships

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	254	7PK - Security Features
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	723	OWASP Top Ten 2004 Category A2 - Broken Access Control
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	944	SFP Secondary Cluster: Access Management
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1031	OWASP Top Ten 2017 Category A5 - Broken Access Control
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	1340	CISQ Data Protection Measures
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1345	OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1369	ICS Supply Chain: IT/OT Convergence/Expansion
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1372	ICS Supply Chain: OT Counterfeit and Malicious Corruption
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1396	Comprehensive Categorization: Access Control

Vulnerability Mapping Notes

Usage

DISCOURAGED

(this CWE ID should not be used to map to real-world vulnerabilities)

Reasons

Frequent Misuse, Abstraction

Rationale

CWE-284 is extremely high-level, a Pillar. Its name, "Improper Access Control," is often misused in low-information vulnerability reports [REF-1287] or by active use of the OWASP Top Ten, such as "A01:2021-Broken Access Control". It is not useful for trend analysis.

Comments

Consider using descendants of CWE-284 that are more specific to the kind of access control involved, such as those involving authorization (Missing Authorization (CWE-862), Incorrect Authorization (CWE-863), Incorrect Permission Assignment for Critical Resource (CWE-732), etc.); authentication (Missing Authentication (CWE-306) or Weak Authentication (CWE-1390)); Incorrect User Management (CWE-286); Improper Restriction of Communication Channel to Intended Endpoints (CWE-923); etc.

Suggestions

CWE-ID	Comment
CWE-862	Missing Authorization
CWE-863	Incorrect Authorization
CWE-732	Incorrect Permission Assignment for Critical Resource
CWE-306	Missing Authentication
CWE-1390	Weak Authentication
CWE-923	Improper Restriction of Communication Channel to Intended Endpoints

Notes

Maintenance

This entry needs more work. Possible sub-categories include:

Trusted group includes undesired entities (partially covered by CWE-286)
Group can perform undesired actions
ACL parse error does not fail closed

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Mapped Node Name
PLOVER		Access Control List (ACL) errors
WASC	2	Insufficient Authorization
7 Pernicious Kingdoms		Missing Access Control

Related Attack Patterns

CAPEC-ID	Attack Pattern Name
CAPEC-19	Embedding Scripts within Scripts
CAPEC-441	Malicious Logic Insertion
CAPEC-478	Modification of Windows Service Configuration
CAPEC-479	Malicious Root Certificate
CAPEC-502	Intent Spoof
CAPEC-503	WebView Exposure
CAPEC-536	Data Injected During Configuration
CAPEC-546	Incomplete Data Deletion in a Multi-Tenant Environment
CAPEC-550	Install New Service
CAPEC-551	Modify Existing Service
CAPEC-552	Install Rootkit
CAPEC-556	Replace File Extension Handlers
CAPEC-558	Replace Trusted Executable
CAPEC-562	Modify Shared File
CAPEC-563	Add Malicious File to Shared Webroot
CAPEC-564	Run Software at Logon
CAPEC-578	Disable Security Software

References

[REF-7]	Michael Howard and David LeBlanc. "Writing Secure Code". Chapter 6, "Determining Appropriate Access Control" Page 171. 2nd Edition. Microsoft Press. 2002-12-04. <https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223>.
[REF-44]	Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security". "Sin 17: Failure to Protect Stored Data." Page 253. McGraw-Hill. 2010.
[REF-1287]	MITRE. "Supplemental Details - 2022 CWE Top 25". Details of Problematic Mappings. 2022-06-28. <https://cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails>. (URL validated: 2024-11-17)

Content History

Submissions
Submission Date	Submitter	Organization
2006-07-19 (CWE Draft 3, 2006-07-19)	PLOVER
2006-07-19 (CWE Draft 3, 2006-07-19)
Modifications
Modification Date	Modifier	Organization
2025-04-03 (CWE 4.17, 2025-04-03)	CWE Content Team	MITRE
2025-04-03 (CWE 4.17, 2025-04-03)	updated Relationships
2024-02-29 (CWE 4.14, 2024-02-29)	CWE Content Team	MITRE
2024-02-29 (CWE 4.14, 2024-02-29)	updated Observed_Examples
2023-10-26	CWE Content Team	MITRE
2023-10-26	updated Observed_Examples
2023-06-29	CWE Content Team	MITRE
2023-06-29	updated Mapping_Notes
2023-04-27	CWE Content Team	MITRE
2023-04-27	updated Relationships
2023-01-31	CWE Content Team	MITRE
2023-01-31	updated Applicable_Platforms, Description, Observed_Examples, Relationships
2022-10-13	CWE Content Team	MITRE
2022-10-13	updated References
2022-06-28	CWE Content Team	MITRE
2022-06-28	updated Observed_Examples
2021-10-28	CWE Content Team	MITRE
2021-10-28	updated Relationships
2021-07-20	CWE Content Team	MITRE
2021-07-20	updated Observed_Examples
2021-03-15	CWE Content Team	MITRE
2021-03-15	updated Maintenance_Notes, Relationships
2020-12-10	CWE Content Team	MITRE
2020-12-10	updated Potential_Mitigations, Relationships
2020-08-20	CWE Content Team	MITRE
2020-08-20	updated Relationships
2020-06-25	CWE Content Team	MITRE
2020-06-25	updated Relationships
2020-02-24	CWE Content Team	MITRE
2020-02-24	updated Relationships, Taxonomy_Mappings, Type
2019-06-20	CWE Content Team	MITRE
2019-06-20	updated Related_Attack_Patterns, Relationships
2019-01-03	CWE Content Team	MITRE
2019-01-03	updated Related_Attack_Patterns
2018-03-27	CWE Content Team	MITRE
2018-03-27	updated References, Relationships
2017-11-08	CWE Content Team	MITRE
2017-11-08	updated Affected_Resources, Modes_of_Introduction, Observed_Examples, References, Relationships
2015-12-07	CWE Content Team	MITRE
2015-12-07	updated Relationships
2014-07-30	CWE Content Team	MITRE
2014-07-30	updated Relationships
2014-06-23	CWE Content Team	MITRE
2014-06-23	updated Relationships
2014-02-18	CWE Content Team	MITRE
2014-02-18	updated Related_Attack_Patterns, Relationships
2012-10-30	CWE Content Team	MITRE
2012-10-30	updated Potential_Mitigations
2012-05-11	CWE Content Team	MITRE
2012-05-11	updated References, Relationships
2011-06-27	CWE Content Team	MITRE
2011-06-27	updated Common_Consequences
2011-06-01	CWE Content Team	MITRE
2011-06-01	updated Common_Consequences
2011-03-29	CWE Content Team	MITRE
2011-03-29	updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships
2011-03-24	CWE Content Team	MITRE
2011-03-24	Changed name and description; clarified difference between "access control" and "authorization."
2010-06-21	CWE Content Team	MITRE
2010-06-21	updated Potential_Mitigations
2010-02-16	CWE Content Team	MITRE
2010-02-16	updated References, Taxonomy_Mappings
2009-12-28	CWE Content Team	MITRE
2009-12-28	updated Potential_Mitigations
2009-07-27	CWE Content Team	MITRE
2009-07-27	updated Alternate_Terms, Relationships
2009-03-10	CWE Content Team	MITRE
2009-03-10	updated Relationships
2008-10-14	CWE Content Team	MITRE
2008-10-14	updated Relationships
2008-09-08	CWE Content Team	MITRE
2008-09-08	updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings
2008-07-01	Eric Dalci	Cigital
2008-07-01	updated Time_of_Introduction
Previous Entry Names
Change Date	Previous Entry Name
2008-09-09	Access Control Issues
2011-03-29	Access Control (Authorization) Issues

Common Weakness Enumeration

CWE VIEW: Weaknesses in OWASP Top Ten (2021)

View Components

CWE-11: ASP.NET Misconfiguration: Creating Debug Binary

Edit Custom Filter

CWE-1174: ASP.NET Misconfiguration: Improper Model Validation

Edit Custom Filter

CWE-13: ASP.NET Misconfiguration: Password in Configuration File

Edit Custom Filter

CWE-302: Authentication Bypass by Assumed-Immutable Data

Edit Custom Filter

CWE-294: Authentication Bypass by Capture-replay

Edit Custom Filter

CWE-290: Authentication Bypass by Spoofing

Edit Custom Filter

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Edit Custom Filter

CWE-639: Authorization Bypass Through User-Controlled Key

Edit Custom Filter

CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key

Edit Custom Filter

CWE CATEGORY: Business Logic Errors

CWE-300: Channel Accessible by Non-Endpoint

Edit Custom Filter

CWE-313: Cleartext Storage in a File or on Disk

Edit Custom Filter

CWE-312: Cleartext Storage of Sensitive Information

Edit Custom Filter

CWE-315: Cleartext Storage of Sensitive Information in a Cookie

Edit Custom Filter

CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable

Edit Custom Filter

CWE-316: Cleartext Storage of Sensitive Information in Memory

Edit Custom Filter

CWE-319: Cleartext Transmission of Sensitive Information

Edit Custom Filter

CWE-602: Client-Side Enforcement of Server-Side Security

Edit Custom Filter

CWE CATEGORY: Configuration

CWE CATEGORY: Credentials Management Errors

CWE-352: Cross-Site Request Forgery (CSRF)

Edit Custom Filter

CWE CATEGORY: Cryptographic Issues

CWE-430: Deployment of Wrong Handler

Edit Custom Filter

CWE-502: Deserialization of Untrusted Data

Edit Custom Filter

CWE-425: Direct Request ('Forced Browsing')

Edit Custom Filter

CWE-494: Download of Code Without Integrity Check

Edit Custom Filter

CWE-548: Exposure of Information Through Directory Listing

Edit Custom Filter

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Edit Custom Filter

CWE-668: Exposure of Resource to Wrong Sphere

Edit Custom Filter

CWE-213: Exposure of Sensitive Information Due to Incompatible Policies

Edit Custom Filter

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Edit Custom Filter

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Edit Custom Filter

CWE-651: Exposure of WSDL File Containing Sensitive Information

Edit Custom Filter

CWE-472: External Control of Assumed-Immutable Web Parameter

Edit Custom Filter

CWE-642: External Control of Critical State Data

Edit Custom Filter

CWE-73: External Control of File Name or Path

Edit Custom Filter

CWE-15: External Control of System or Configuration Setting

Edit Custom Filter

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Edit Custom Filter

CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Edit Custom Filter

CWE-552: Files or Directories Accessible to External Parties

Edit Custom Filter

CWE-209: Generation of Error Message Containing Sensitive Information