CWE

Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > VIEW SLICE: CWE-2000: Comprehensive CWE Dictionary (3.0)  
ID

CWE VIEW: Comprehensive CWE Dictionary

View ID: 2000
Type: Implicit
Status: Draft
+ Objective
This view (slice) covers all the elements in CWE.
+ Filter
/Weakness_Catalog/*[not(self::External_References)]/*
+ Membership
NatureTypeIDName
HasMemberDeprecatedDeprecated1DEPRECATED: Location
HasMemberCategoryCategory27PK - Environment
HasMemberDeprecatedDeprecated3DEPRECATED: Technology-specific Environment Issues
HasMemberCategoryCategory4J2EE Environment Issues
HasMemberVariantVariant5J2EE Misconfiguration: Data Transmission Without Encryption
HasMemberVariantVariant6J2EE Misconfiguration: Insufficient Session-ID Length
HasMemberVariantVariant7J2EE Misconfiguration: Missing Custom Error Page
HasMemberVariantVariant8J2EE Misconfiguration: Entity Bean Declared Remote
HasMemberVariantVariant9J2EE Misconfiguration: Weak Access Permissions for EJB Methods
HasMemberDeprecatedDeprecated10DEPRECATED: ASP.NET Environment Issues
HasMemberVariantVariant11ASP.NET Misconfiguration: Creating Debug Binary
HasMemberVariantVariant12ASP.NET Misconfiguration: Missing Custom Error Page
HasMemberVariantVariant13ASP.NET Misconfiguration: Password in Configuration File
HasMemberBaseBase14Compiler Removal of Code to Clear Buffers
HasMemberBaseBase15External Control of System or Configuration Setting
HasMemberCategoryCategory16Configuration
HasMemberCategoryCategory17Code
HasMemberCategoryCategory18Source Code
HasMemberCategoryCategory19Data Processing Errors
HasMemberClassClass20Improper Input Validation
HasMemberCategoryCategory21Pathname Traversal and Equivalence Errors
HasMemberClassClass22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
HasMemberBaseBase23Relative Path Traversal
HasMemberVariantVariant24Path Traversal: '../filedir'
HasMemberVariantVariant25Path Traversal: '/../filedir'
HasMemberVariantVariant26Path Traversal: '/dir/../filename'
HasMemberVariantVariant27Path Traversal: 'dir/../../filename'
HasMemberVariantVariant28Path Traversal: '..\filedir'
HasMemberVariantVariant29Path Traversal: '\..\filename'
HasMemberVariantVariant30Path Traversal: '\dir\..\filename'
HasMemberVariantVariant31Path Traversal: 'dir\..\..\filename'
HasMemberVariantVariant32Path Traversal: '...' (Triple Dot)
HasMemberVariantVariant33Path Traversal: '....' (Multiple Dot)
HasMemberVariantVariant34Path Traversal: '....//'
HasMemberVariantVariant35Path Traversal: '.../...//'
HasMemberBaseBase36Absolute Path Traversal
HasMemberVariantVariant37Path Traversal: '/absolute/pathname/here'
HasMemberVariantVariant38Path Traversal: '\absolute\pathname\here'
HasMemberVariantVariant39Path Traversal: 'C:dirname'
HasMemberVariantVariant40Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
HasMemberBaseBase41Improper Resolution of Path Equivalence
HasMemberVariantVariant42Path Equivalence: 'filename.' (Trailing Dot)
HasMemberVariantVariant43Path Equivalence: 'filename....' (Multiple Trailing Dot)
HasMemberVariantVariant44Path Equivalence: 'file.name' (Internal Dot)
HasMemberVariantVariant45Path Equivalence: 'file...name' (Multiple Internal Dot)
HasMemberVariantVariant46Path Equivalence: 'filename ' (Trailing Space)
HasMemberVariantVariant47Path Equivalence: ' filename' (Leading Space)
HasMemberVariantVariant48Path Equivalence: 'file name' (Internal Whitespace)
HasMemberVariantVariant49Path Equivalence: 'filename/' (Trailing Slash)
HasMemberVariantVariant50Path Equivalence: '//multiple/leading/slash'
HasMemberVariantVariant51Path Equivalence: '/multiple//internal/slash'
HasMemberVariantVariant52Path Equivalence: '/multiple/trailing/slash//'
HasMemberVariantVariant53Path Equivalence: '\multiple\\internal\backslash'
HasMemberVariantVariant54Path Equivalence: 'filedir\' (Trailing Backslash)
HasMemberVariantVariant55Path Equivalence: '/./' (Single Dot Directory)
HasMemberVariantVariant56Path Equivalence: 'filedir*' (Wildcard)
HasMemberVariantVariant57Path Equivalence: 'fakedir/../realdir/filename'
HasMemberVariantVariant58Path Equivalence: Windows 8.3 Filename
HasMemberBaseBase59Improper Link Resolution Before File Access ('Link Following')
HasMemberDeprecatedDeprecated60DEPRECATED: UNIX Path Link Problems
HasMemberCompositeComposite61UNIX Symbolic Link (Symlink) Following
HasMemberVariantVariant62UNIX Hard Link
HasMemberDeprecatedDeprecated63DEPRECATED: Windows Path Link Problems
HasMemberVariantVariant64Windows Shortcut Following (.LNK)
HasMemberVariantVariant65Windows Hard Link
HasMemberBaseBase66Improper Handling of File Names that Identify Virtual Resources
HasMemberVariantVariant67Improper Handling of Windows Device Names
HasMemberDeprecatedDeprecated68DEPRECATED: Windows Virtual File Problems
HasMemberVariantVariant69Improper Handling of Windows ::DATA Alternate Data Stream
HasMemberDeprecatedDeprecated70DEPRECATED: Mac Virtual File Problems
HasMemberDeprecatedDeprecated71DEPRECATED: Apple '.DS_Store'
HasMemberVariantVariant72Improper Handling of Apple HFS+ Alternate Data Stream Path
HasMemberClassClass73External Control of File Name or Path
HasMemberClassClass74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
HasMemberClassClass75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
HasMemberBaseBase76Improper Neutralization of Equivalent Special Elements
HasMemberClassClass77Improper Neutralization of Special Elements used in a Command ('Command Injection')
HasMemberBaseBase78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
HasMemberBaseBase79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
HasMemberVariantVariant80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
HasMemberVariantVariant81Improper Neutralization of Script in an Error Message Web Page
HasMemberVariantVariant82Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
HasMemberVariantVariant83Improper Neutralization of Script in Attributes in a Web Page
HasMemberVariantVariant84Improper Neutralization of Encoded URI Schemes in a Web Page
HasMemberVariantVariant85Doubled Character XSS Manipulations
HasMemberVariantVariant86Improper Neutralization of Invalid Characters in Identifiers in Web Pages
HasMemberVariantVariant87Improper Neutralization of Alternate XSS Syntax
HasMemberBaseBase88Argument Injection or Modification
HasMemberBaseBase89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
HasMemberBaseBase90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
HasMemberBaseBase91XML Injection (aka Blind XPath Injection)
HasMemberDeprecatedDeprecated92DEPRECATED: Improper Sanitization of Custom Special Characters
HasMemberBaseBase93Improper Neutralization of CRLF Sequences ('CRLF Injection')
HasMemberClassClass94Improper Control of Generation of Code ('Code Injection')
HasMemberBaseBase95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
HasMemberBaseBase96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
HasMemberVariantVariant97Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
HasMemberBaseBase98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
HasMemberBaseBase99Improper Control of Resource Identifiers ('Resource Injection')
HasMemberDeprecatedDeprecated100DEPRECATED: Technology-Specific Input Validation Problems
HasMemberDeprecatedDeprecated101DEPRECATED: Struts Validation Problems
HasMemberVariantVariant102Struts: Duplicate Validation Forms
HasMemberVariantVariant103Struts: Incomplete validate() Method Definition
HasMemberVariantVariant104Struts: Form Bean Does Not Extend Validation Class
HasMemberVariantVariant105Struts: Form Field Without Validator
HasMemberVariantVariant106Struts: Plug-in Framework not in Use
HasMemberVariantVariant107Struts: Unused Validation Form
HasMemberVariantVariant108Struts: Unvalidated Action Form
HasMemberVariantVariant109Struts: Validator Turned Off
HasMemberVariantVariant110Struts: Validator Without Form Field
HasMemberBaseBase111Direct Use of Unsafe JNI
HasMemberBaseBase112Missing XML Validation
HasMemberBaseBase113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
HasMemberBaseBase114Process Control
HasMemberBaseBase115Misinterpretation of Input
HasMemberClassClass116Improper Encoding or Escaping of Output
HasMemberBaseBase117Improper Output Neutralization for Logs
HasMemberClassClass118Incorrect Access of Indexable Resource ('Range Error')
HasMemberClassClass119Improper Restriction of Operations within the Bounds of a Memory Buffer
HasMemberBaseBase120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
HasMemberVariantVariant121Stack-based Buffer Overflow
HasMemberVariantVariant122Heap-based Buffer Overflow
HasMemberBaseBase123Write-what-where Condition
HasMemberBaseBase124Buffer Underwrite ('Buffer Underflow')
HasMemberBaseBase125Out-of-bounds Read
HasMemberVariantVariant126Buffer Over-read
HasMemberVariantVariant127Buffer Under-read
HasMemberBaseBase128Wrap-around Error
HasMemberBaseBase129Improper Validation of Array Index
HasMemberBaseBase130Improper Handling of Length Parameter Inconsistency
HasMemberBaseBase131Incorrect Calculation of Buffer Size
HasMemberDeprecatedDeprecated132DEPRECATED (Duplicate): Miscalculated Null Termination
HasMemberCategoryCategory133String Errors
HasMemberBaseBase134Use of Externally-Controlled Format String
HasMemberBaseBase135Incorrect Calculation of Multi-Byte String Length
HasMemberCategoryCategory136Type Errors
HasMemberCategoryCategory137Representation Errors
HasMemberClassClass138Improper Neutralization of Special Elements
HasMemberDeprecatedDeprecated139DEPRECATED: General Special Element Problems
HasMemberBaseBase140Improper Neutralization of Delimiters
HasMemberVariantVariant141Improper Neutralization of Parameter/Argument Delimiters
HasMemberVariantVariant142Improper Neutralization of Value Delimiters
HasMemberVariantVariant143Improper Neutralization of Record Delimiters
HasMemberVariantVariant144Improper Neutralization of Line Delimiters
HasMemberVariantVariant145Improper Neutralization of Section Delimiters
HasMemberVariantVariant146Improper Neutralization of Expression/Command Delimiters
HasMemberVariantVariant147Improper Neutralization of Input Terminators
HasMemberVariantVariant148Improper Neutralization of Input Leaders
HasMemberVariantVariant149Improper Neutralization of Quoting Syntax
HasMemberVariantVariant150Improper Neutralization of Escape, Meta, or Control Sequences
HasMemberVariantVariant151Improper Neutralization of Comment Delimiters
HasMemberVariantVariant152Improper Neutralization of Macro Symbols
HasMemberVariantVariant153Improper Neutralization of Substitution Characters
HasMemberVariantVariant154Improper Neutralization of Variable Name Delimiters
HasMemberVariantVariant155Improper Neutralization of Wildcards or Matching Symbols
HasMemberVariantVariant156Improper Neutralization of Whitespace
HasMemberVariantVariant157Failure to Sanitize Paired Delimiters
HasMemberVariantVariant158Improper Neutralization of Null Byte or NUL Character
HasMemberClassClass159Failure to Sanitize Special Element
HasMemberVariantVariant160Improper Neutralization of Leading Special Elements
HasMemberVariantVariant161Improper Neutralization of Multiple Leading Special Elements
HasMemberVariantVariant162Improper Neutralization of Trailing Special Elements
HasMemberVariantVariant163Improper Neutralization of Multiple Trailing Special Elements
HasMemberVariantVariant164Improper Neutralization of Internal Special Elements
HasMemberVariantVariant165Improper Neutralization of Multiple Internal Special Elements
HasMemberBaseBase166Improper Handling of Missing Special Element
HasMemberBaseBase167Improper Handling of Additional Special Element
HasMemberBaseBase168Improper Handling of Inconsistent Special Elements
HasMemberDeprecatedDeprecated169DEPRECATED: Technology-Specific Special Elements
HasMemberBaseBase170Improper Null Termination
HasMemberCategoryCategory171Cleansing, Canonicalization, and Comparison Errors
HasMemberClassClass172Encoding Error
HasMemberVariantVariant173Improper Handling of Alternate Encoding
HasMemberVariantVariant174Double Decoding of the Same Data
HasMemberVariantVariant175Improper Handling of Mixed Encoding
HasMemberVariantVariant176Improper Handling of Unicode Encoding
HasMemberVariantVariant177Improper Handling of URL Encoding (Hex Encoding)
HasMemberBaseBase178Improper Handling of Case Sensitivity
HasMemberBaseBase179Incorrect Behavior Order: Early Validation
HasMemberBaseBase180Incorrect Behavior Order: Validate Before Canonicalize
HasMemberBaseBase181Incorrect Behavior Order: Validate Before Filter
HasMemberBaseBase182Collapse of Data into Unsafe Value
HasMemberBaseBase183Permissive Whitelist
HasMemberBaseBase184Incomplete Blacklist
HasMemberClassClass185Incorrect Regular Expression
HasMemberBaseBase186Overly Restrictive Regular Expression
HasMemberBaseBase187Partial Comparison
HasMemberBaseBase188Reliance on Data/Memory Layout
HasMemberCategoryCategory189Numeric Errors
HasMemberBaseBase190Integer Overflow or Wraparound
HasMemberBaseBase191Integer Underflow (Wrap or Wraparound)
HasMemberClassClass192Integer Coercion Error
HasMemberBaseBase193Off-by-one Error
HasMemberBaseBase194Unexpected Sign Extension
HasMemberVariantVariant195Signed to Unsigned Conversion Error
HasMemberVariantVariant196Unsigned to Signed Conversion Error
HasMemberBaseBase197Numeric Truncation Error
HasMemberBaseBase198Use of Incorrect Byte Ordering
HasMemberCategoryCategory199Information Management Errors
HasMemberClassClass200Information Exposure
HasMemberVariantVariant201Information Exposure Through Sent Data
HasMemberVariantVariant202Exposure of Sensitive Data Through Data Queries
HasMemberClassClass203Information Exposure Through Discrepancy
HasMemberBaseBase204Response Discrepancy Information Exposure
HasMemberBaseBase205Information Exposure Through Behavioral Discrepancy
HasMemberVariantVariant206Information Exposure of Internal State Through Behavioral Inconsistency
HasMemberVariantVariant207Information Exposure Through an External Behavioral Inconsistency
HasMemberBaseBase208Information Exposure Through Timing Discrepancy
HasMemberBaseBase209Information Exposure Through an Error Message
HasMemberBaseBase210Information Exposure Through Self-generated Error Message
HasMemberBaseBase211Information Exposure Through Externally-Generated Error Message
HasMemberBaseBase212Improper Cross-boundary Removal of Sensitive Data
HasMemberBaseBase213Intentional Information Exposure
HasMemberVariantVariant214Information Exposure Through Process Environment
HasMemberVariantVariant215Information Exposure Through Debug Information
HasMemberClassClass216Containment Errors (Container Errors)
HasMemberDeprecatedDeprecated217DEPRECATED: Failure to Protect Stored Data from Modification
HasMemberDeprecatedDeprecated218DEPRECATED (Duplicate): Failure to provide confidentiality for stored data
HasMemberVariantVariant219Sensitive Data Under Web Root
HasMemberVariantVariant220Sensitive Data Under FTP Root
HasMemberClassClass221Information Loss or Omission
HasMemberBaseBase222Truncation of Security-relevant Information
HasMemberBaseBase223Omission of Security-relevant Information
HasMemberBaseBase224Obscured Security-relevant Information by Alternate Name
HasMemberDeprecatedDeprecated225DEPRECATED (Duplicate): General Information Management Problems
HasMemberBaseBase226Sensitive Information Uncleared Before Release
HasMemberCategoryCategory2277PK - API Abuse
HasMemberClassClass228Improper Handling of Syntactically Invalid Structure
HasMemberBaseBase229Improper Handling of Values
HasMemberVariantVariant230Improper Handling of Missing Values
HasMemberVariantVariant231Improper Handling of Extra Values
HasMemberVariantVariant232Improper Handling of Undefined Values
HasMemberBaseBase233Improper Handling of Parameters
HasMemberVariantVariant234Failure to Handle Missing Parameter
HasMemberVariantVariant235Improper Handling of Extra Parameters
HasMemberVariantVariant236Improper Handling of Undefined Parameters
HasMemberBaseBase237Improper Handling of Structural Elements
HasMemberVariantVariant238Improper Handling of Incomplete Structural Elements
HasMemberVariantVariant239Failure to Handle Incomplete Element
HasMemberBaseBase240Improper Handling of Inconsistent Structural Elements
HasMemberBaseBase241Improper Handling of Unexpected Data Type
HasMemberBaseBase242Use of Inherently Dangerous Function
HasMemberVariantVariant243Creation of chroot Jail Without Changing Working Directory
HasMemberVariantVariant244Improper Clearing of Heap Memory Before Release ('Heap Inspection')
HasMemberVariantVariant245J2EE Bad Practices: Direct Management of Connections
HasMemberVariantVariant246J2EE Bad Practices: Direct Use of Sockets
HasMemberDeprecatedDeprecated247DEPRECATED (Duplicate): Reliance on DNS Lookups in a Security Decision
HasMemberBaseBase248Uncaught Exception
HasMemberDeprecatedDeprecated249DEPRECATED: Often Misused: Path Manipulation
HasMemberClassClass250Execution with Unnecessary Privileges
HasMemberCategoryCategory251Often Misused: String Management
HasMemberBaseBase252Unchecked Return Value
HasMemberBaseBase253Incorrect Check of Function Return Value
HasMemberCategoryCategory2547PK - Security Features
HasMemberCategoryCategory255Credentials Management
HasMemberVariantVariant256Plaintext Storage of a Password
HasMemberBaseBase257Storing Passwords in a Recoverable Format
HasMemberVariantVariant258Empty Password in Configuration File
HasMemberBaseBase259Use of Hard-coded Password
HasMemberVariantVariant260Password in Configuration File
HasMemberVariantVariant261Weak Cryptography for Passwords
HasMemberVariantVariant262Not Using Password Aging
HasMemberBaseBase263Password Aging with Long Expiration
HasMemberCategoryCategory264Permissions, Privileges, and Access Controls
HasMemberCategoryCategory265Privilege / Sandbox Issues
HasMemberBaseBase266Incorrect Privilege Assignment
HasMemberBaseBase267Privilege Defined With Unsafe Actions
HasMemberBaseBase268Privilege Chaining
HasMemberClassClass269Improper Privilege Management
HasMemberBaseBase270Privilege Context Switching Error
HasMemberClassClass271Privilege Dropping / Lowering Errors
HasMemberBaseBase272Least Privilege Violation
HasMemberBaseBase273Improper Check for Dropped Privileges
HasMemberBaseBase274Improper Handling of Insufficient Privileges
HasMemberCategoryCategory275Permission Issues
HasMemberVariantVariant276Incorrect Default Permissions
HasMemberVariantVariant277Insecure Inherited Permissions
HasMemberVariantVariant278Insecure Preserved Inherited Permissions
HasMemberVariantVariant279Incorrect Execution-Assigned Permissions
HasMemberBaseBase280Improper Handling of Insufficient Permissions or Privileges
HasMemberBaseBase281Improper Preservation of Permissions
HasMemberClassClass282Improper Ownership Management
HasMemberBaseBase283Unverified Ownership
HasMemberClassClass284Improper Access Control
HasMemberClassClass285Improper Authorization
HasMemberClassClass286Incorrect User Management
HasMemberClassClass287Improper Authentication
HasMemberBaseBase288Authentication Bypass Using an Alternate Path or Channel
HasMemberVariantVariant289Authentication Bypass by Alternate Name
HasMemberBaseBase290Authentication Bypass by Spoofing
HasMemberVariantVariant291Reliance on IP Address for Authentication
HasMemberDeprecatedDeprecated292DEPRECATED (Duplicate): Trusting Self-reported DNS Name
HasMemberVariantVariant293Using Referer Field for Authentication
HasMemberBaseBase294Authentication Bypass by Capture-replay
HasMemberBaseBase295Improper Certificate Validation
HasMemberBaseBase296Improper Following of a Certificate's Chain of Trust
HasMemberVariantVariant297Improper Validation of Certificate with Host Mismatch
HasMemberVariantVariant298Improper Validation of Certificate Expiration
HasMemberBaseBase299Improper Check for Certificate Revocation
HasMemberClassClass300Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
HasMemberVariantVariant301Reflection Attack in an Authentication Protocol
HasMemberVariantVariant302Authentication Bypass by Assumed-Immutable Data
HasMemberBaseBase303Incorrect Implementation of Authentication Algorithm
HasMemberBaseBase304Missing Critical Step in Authentication
HasMemberBaseBase305Authentication Bypass by Primary Weakness
HasMemberVariantVariant306Missing Authentication for Critical Function
HasMemberBaseBase307Improper Restriction of Excessive Authentication Attempts
HasMemberBaseBase308Use of Single-factor Authentication
HasMemberBaseBase309Use of Password System for Primary Authentication
HasMemberCategoryCategory310Cryptographic Issues
HasMemberBaseBase311Missing Encryption of Sensitive Data
HasMemberBaseBase312Cleartext Storage of Sensitive Information
HasMemberVariantVariant313Cleartext Storage in a File or on Disk
HasMemberVariantVariant314Cleartext Storage in the Registry
HasMemberVariantVariant315Cleartext Storage of Sensitive Information in a Cookie
HasMemberVariantVariant316Cleartext Storage of Sensitive Information in Memory
HasMemberVariantVariant317Cleartext Storage of Sensitive Information in GUI
HasMemberVariantVariant318Cleartext Storage of Sensitive Information in Executable
HasMemberBaseBase319Cleartext Transmission of Sensitive Information
HasMemberCategoryCategory320Key Management Errors
HasMemberBaseBase321Use of Hard-coded Cryptographic Key
HasMemberBaseBase322Key Exchange without Entity Authentication
HasMemberBaseBase323Reusing a Nonce, Key Pair in Encryption
HasMemberBaseBase324Use of a Key Past its Expiration Date
HasMemberBaseBase325Missing Required Cryptographic Step
HasMemberClassClass326Inadequate Encryption Strength
HasMemberBaseBase327Use of a Broken or Risky Cryptographic Algorithm
HasMemberBaseBase328Reversible One-Way Hash
HasMemberVariantVariant329Not Using a Random IV with CBC Mode
HasMemberClassClass330Use of Insufficiently Random Values
HasMemberBaseBase331Insufficient Entropy
HasMemberVariantVariant332Insufficient Entropy in PRNG
HasMemberVariantVariant333Improper Handling of Insufficient Entropy in TRNG
HasMemberBaseBase334Small Space of Random Values
HasMemberBaseBase335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
HasMemberBaseBase336Same Seed in Pseudo-Random Number Generator (PRNG)
HasMemberBaseBase337Predictable Seed in Pseudo-Random Number Generator (PRNG)
HasMemberBaseBase338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
HasMemberBaseBase339Small Seed Space in PRNG
HasMemberClassClass340Predictability Problems
HasMemberBaseBase341Predictable from Observable State
HasMemberBaseBase342Predictable Exact Value from Previous Values
HasMemberBaseBase343Predictable Value Range from Previous Values
HasMemberBaseBase344Use of Invariant Value in Dynamically Changing Context
HasMemberClassClass345Insufficient Verification of Data Authenticity
HasMemberBaseBase346Origin Validation Error
HasMemberBaseBase347Improper Verification of Cryptographic Signature
HasMemberBaseBase348Use of Less Trusted Source
HasMemberBaseBase349Acceptance of Extraneous Untrusted Data With Trusted Data
HasMemberVariantVariant350Reliance on Reverse DNS Resolution for a Security-Critical Action
HasMemberBaseBase351Insufficient Type Distinction
HasMemberCompositeComposite352Cross-Site Request Forgery (CSRF)
HasMemberBaseBase353Missing Support for Integrity Check
HasMemberBaseBase354Improper Validation of Integrity Check Value
HasMemberCategoryCategory355User Interface Security Issues
HasMemberBaseBase356Product UI does not Warn User of Unsafe Actions
HasMemberBaseBase357Insufficient UI Warning of Dangerous Operations
HasMemberBaseBase358Improperly Implemented Security Check for Standard
HasMemberClassClass359Exposure of Private Information ('Privacy Violation')
HasMemberBaseBase360Trust of System Event Data
HasMemberCategoryCategory3617PK - Time and State
HasMemberClassClass362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
HasMemberBaseBase363Race Condition Enabling Link Following
HasMemberBaseBase364Signal Handler Race Condition
HasMemberBaseBase365Race Condition in Switch
HasMemberBaseBase366Race Condition within a Thread
HasMemberBaseBase367Time-of-check Time-of-use (TOCTOU) Race Condition
HasMemberBaseBase368Context Switching Race Condition
HasMemberBaseBase369Divide By Zero
HasMemberVariantVariant370Missing Check for Certificate Revocation after Initial Check
HasMemberCategoryCategory371State Issues
HasMemberBaseBase372Incomplete Internal State Distinction
HasMemberDeprecatedDeprecated373DEPRECATED: State Synchronization Error
HasMemberBaseBase374Passing Mutable Objects to an Untrusted Method
HasMemberBaseBase375Returning a Mutable Object to an Untrusted Caller
HasMemberCategoryCategory376Temporary File Issues
HasMemberBaseBase377Insecure Temporary File
HasMemberBaseBase378Creation of Temporary File With Insecure Permissions
HasMemberBaseBase379Creation of Temporary File in Directory with Incorrect Permissions
HasMemberCategoryCategory380Technology-Specific Time and State Issues
HasMemberCategoryCategory381J2EE Time and State Issues
HasMemberVariantVariant382J2EE Bad Practices: Use of System.exit()
HasMemberVariantVariant383J2EE Bad Practices: Direct Use of Threads
HasMemberCompositeComposite384Session Fixation
HasMemberBaseBase385Covert Timing Channel
HasMemberBaseBase386Symbolic Name not Mapping to Correct Object
HasMemberCategoryCategory387Signal Errors
HasMemberCategoryCategory3887PK - Errors
HasMemberCategoryCategory389Error Conditions, Return Values, Status Codes
HasMemberClassClass390Detection of Error Condition Without Action
HasMemberBaseBase391Unchecked Error Condition
HasMemberBaseBase392Missing Report of Error Condition
HasMemberBaseBase393Return of Wrong Status Code
HasMemberBaseBase394Unexpected Status Code or Return Value
HasMemberBaseBase395Use of NullPointerException Catch to Detect NULL Pointer Dereference
HasMemberBaseBase396Declaration of Catch for Generic Exception
HasMemberBaseBase397Declaration of Throws for Generic Exception
HasMemberCategoryCategory3987PK - Code Quality
HasMemberCategoryCategory399Resource Management Errors
HasMemberBaseBase400Uncontrolled Resource Consumption ('Resource Exhaustion')
HasMemberBaseBase401Improper Release of Memory Before Removing Last Reference ('Memory Leak')
HasMemberClassClass402Transmission of Private Resources into a New Sphere ('Resource Leak')
HasMemberBaseBase403Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
HasMemberBaseBase404Improper Resource Shutdown or Release
HasMemberClassClass405Asymmetric Resource Consumption (Amplification)
HasMemberBaseBase406Insufficient Control of Network Message Volume (Network Amplification)
HasMemberBaseBase407Algorithmic Complexity
HasMemberBaseBase408Incorrect Behavior Order: Early Amplification
HasMemberBaseBase409Improper Handling of Highly Compressed Data (Data Amplification)
HasMemberBaseBase410Insufficient Resource Pool
HasMemberCategoryCategory411Resource Locking Problems
HasMemberBaseBase412Unrestricted Externally Accessible Lock
HasMemberBaseBase413Improper Resource Locking
HasMemberBaseBase414Missing Lock Check
HasMemberVariantVariant415Double Free
HasMemberBaseBase416Use After Free
HasMemberCategoryCategory417Channel and Path Errors
HasMemberDeprecatedDeprecated418DEPRECATED: Channel Errors
HasMemberBaseBase419Unprotected Primary Channel
HasMemberBaseBase420Unprotected Alternate Channel
HasMemberBaseBase421Race Condition During Access to Alternate Channel
HasMemberVariantVariant422Unprotected Windows Messaging Channel ('Shatter')
HasMemberDeprecatedDeprecated423DEPRECATED (Duplicate): Proxied Trusted Channel
HasMemberClassClass424Improper Protection of Alternate Path
HasMemberBaseBase425Direct Request ('Forced Browsing')
HasMemberCompositeComposite426Untrusted Search Path
HasMemberBaseBase427Uncontrolled Search Path Element
HasMemberBaseBase428Unquoted Search Path or Element
HasMemberCategoryCategory429Handler Errors
HasMemberBaseBase430Deployment of Wrong Handler
HasMemberBaseBase431Missing Handler
HasMemberBaseBase432Dangerous Signal Handler not Disabled During Sensitive Operations
HasMemberVariantVariant433Unparsed Raw Web Content Delivery
HasMemberBaseBase434Unrestricted Upload of File with Dangerous Type
HasMemberClassClass435Improper Interaction Between Multiple Entities
HasMemberBaseBase436Interpretation Conflict
HasMemberBaseBase437Incomplete Model of Endpoint Features
HasMemberCategoryCategory438Behavioral Problems
HasMemberBaseBase439Behavioral Change in New Version or Environment
HasMemberBaseBase440Expected Behavior Violation
HasMemberClassClass441Unintended Proxy or Intermediary ('Confused Deputy')
HasMemberCategoryCategory442Web Problems
HasMemberDeprecatedDeprecated443DEPRECATED (Duplicate): HTTP response splitting
HasMemberBaseBase444Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
HasMemberDeprecatedDeprecated445DEPRECATED: User Interface Errors
HasMemberBaseBase446UI Discrepancy for Security Feature
HasMemberBaseBase447Unimplemented or Unsupported Feature in UI
HasMemberBaseBase448Obsolete Feature in UI
HasMemberBaseBase449The UI Performs the Wrong Action
HasMemberBaseBase450Multiple Interpretations of UI Input
HasMemberClassClass451User Interface (UI) Misrepresentation of Critical Information
HasMemberCategoryCategory452Initialization and Cleanup Errors
HasMemberBaseBase453Insecure Default Variable Initialization
HasMemberBaseBase454External Initialization of Trusted Variables or Data Stores
HasMemberBaseBase455Non-exit on Failed Initialization
HasMemberBaseBase456Missing Initialization of a Variable
HasMemberVariantVariant457Use of Uninitialized Variable
HasMemberDeprecatedDeprecated458DEPRECATED: Incorrect Initialization
HasMemberBaseBase459Incomplete Cleanup
HasMemberVariantVariant460Improper Cleanup on Thrown Exception
HasMemberCategoryCategory461Data Structure Issues
HasMemberBaseBase462Duplicate Key in Associative List (Alist)
HasMemberBaseBase463Deletion of Data Structure Sentinel
HasMemberBaseBase464Addition of Data Structure Sentinel
HasMemberCategoryCategory465Pointer Issues
HasMemberBaseBase466Return of Pointer Value Outside of Expected Range
HasMemberVariantVariant467Use of sizeof() on a Pointer Type
HasMemberBaseBase468Incorrect Pointer Scaling
HasMemberBaseBase469Use of Pointer Subtraction to Determine Size
HasMemberBaseBase470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
HasMemberBaseBase471Modification of Assumed-Immutable Data (MAID)
HasMemberBaseBase472External Control of Assumed-Immutable Web Parameter
HasMemberVariantVariant473PHP External Variable Modification
HasMemberBaseBase474Use of Function with Inconsistent Implementations
HasMemberBaseBase475Undefined Behavior for Input to API
HasMemberBaseBase476NULL Pointer Dereference
HasMemberBaseBase477Use of Obsolete Function
HasMemberVariantVariant478Missing Default Case in Switch Statement
HasMemberVariantVariant479Signal Handler Use of a Non-reentrant Function
HasMemberBaseBase480Use of Incorrect Operator
HasMemberVariantVariant481Assigning instead of Comparing
HasMemberVariantVariant482Comparing instead of Assigning
HasMemberVariantVariant483Incorrect Block Delimitation
HasMemberBaseBase484Omitted Break Statement in Switch
HasMemberCategoryCategory4857PK - Encapsulation
HasMemberVariantVariant486Comparison of Classes by Name
HasMemberVariantVariant487Reliance on Package-level Scope
HasMemberVariantVariant488Exposure of Data Element to Wrong Session
HasMemberBaseBase489Leftover Debug Code
HasMemberCategoryCategory490Mobile Code Issues
HasMemberVariantVariant491Public cloneable() Method Without Final ('Object Hijack')
HasMemberVariantVariant492Use of Inner Class Containing Sensitive Data
HasMemberVariantVariant493Critical Public Variable Without Final Modifier
HasMemberBaseBase494Download of Code Without Integrity Check
HasMemberVariantVariant495Private Array-Typed Field Returned From A Public Method
HasMemberVariantVariant496Public Data Assigned to Private Array-Typed Field
HasMemberVariantVariant497Exposure of System Data to an Unauthorized Control Sphere
HasMemberVariantVariant498Cloneable Class Containing Sensitive Information
HasMemberVariantVariant499Serializable Class Containing Sensitive Data
HasMemberVariantVariant500Public Static Field Not Marked Final
HasMemberBaseBase501Trust Boundary Violation
HasMemberVariantVariant502Deserialization of Untrusted Data
HasMemberDeprecatedDeprecated503DEPRECATED: Byte/Object Code
HasMemberDeprecatedDeprecated504DEPRECATED: Motivation/Intent
HasMemberDeprecatedDeprecated505DEPRECATED: Intentionally Introduced Weakness
HasMemberClassClass506Embedded Malicious Code
HasMemberBaseBase507Trojan Horse
HasMemberBaseBase508Non-Replicating Malicious Code
HasMemberBaseBase509Replicating Malicious Code (Virus or Worm)
HasMemberBaseBase510Trapdoor
HasMemberBaseBase511Logic/Time Bomb
HasMemberBaseBase512Spyware
HasMemberDeprecatedDeprecated513DEPRECATED: Intentionally Introduced Nonmalicious Weakness
HasMemberClassClass514Covert Channel
HasMemberBaseBase515Covert Storage Channel
HasMemberDeprecatedDeprecated516DEPRECATED (Duplicate): Covert Timing Channel
HasMemberDeprecatedDeprecated517DEPRECATED: Other Intentional, Nonmalicious Weakness
HasMemberDeprecatedDeprecated518DEPRECATED: Inadvertently Introduced Weakness
HasMemberCategoryCategory519.NET Environment Issues
HasMemberVariantVariant520.NET Misconfiguration: Use of Impersonation
HasMemberBaseBase521Weak Password Requirements
HasMemberBaseBase522Insufficiently Protected Credentials
HasMemberVariantVariant523Unprotected Transport of Credentials
HasMemberVariantVariant524Information Exposure Through Caching
HasMemberVariantVariant525Information Exposure Through Browser Caching
HasMemberVariantVariant526Information Exposure Through Environmental Variables
HasMemberVariantVariant527Exposure of CVS Repository to an Unauthorized Control Sphere
HasMemberVariantVariant528Exposure of Core Dump File to an Unauthorized Control Sphere
HasMemberVariantVariant529Exposure of Access Control List Files to an Unauthorized Control Sphere
HasMemberVariantVariant530Exposure of Backup File to an Unauthorized Control Sphere
HasMemberVariantVariant531Information Exposure Through Test Code
HasMemberVariantVariant532Information Exposure Through Log Files
HasMemberVariantVariant533Information Exposure Through Server Log Files
HasMemberVariantVariant534Information Exposure Through Debug Log Files
HasMemberVariantVariant535Information Exposure Through Shell Error Message
HasMemberVariantVariant536Information Exposure Through Servlet Runtime Error Message
HasMemberVariantVariant537Information Exposure Through Java Runtime Error Message
HasMemberBaseBase538File and Directory Information Exposure
HasMemberVariantVariant539Information Exposure Through Persistent Cookies
HasMemberVariantVariant540Information Exposure Through Source Code
HasMemberVariantVariant541Information Exposure Through Include Source Code
HasMemberVariantVariant542Information Exposure Through Cleanup Log Files
HasMemberVariantVariant543Use of Singleton Pattern Without Synchronization in a Multithreaded Context
HasMemberBaseBase544Missing Standardized Error Handling Mechanism
HasMemberDeprecatedDeprecated545DEPRECATED: Use of Dynamic Class Loading
HasMemberVariantVariant546Suspicious Comment
HasMemberVariantVariant547Use of Hard-coded, Security-relevant Constants
HasMemberVariantVariant548Information Exposure Through Directory Listing
HasMemberVariantVariant549Missing Password Field Masking
HasMemberVariantVariant550Information Exposure Through Server Error Message
HasMemberBaseBase551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
HasMemberBaseBase552Files or Directories Accessible to External Parties
HasMemberVariantVariant553Command Shell in Externally Accessible Directory
HasMemberVariantVariant554ASP.NET Misconfiguration: Not Using Input Validation Framework
HasMemberVariantVariant555J2EE Misconfiguration: Plaintext Password in Configuration File
HasMemberVariantVariant556ASP.NET Misconfiguration: Use of Identity Impersonation
HasMemberCategoryCategory557Concurrency Issues
HasMemberVariantVariant558Use of getlogin() in Multithreaded Application
HasMemberCategoryCategory559Often Misused: Arguments and Parameters
HasMemberVariantVariant560Use of umask() with chmod-style Argument
HasMemberVariantVariant561Dead Code
HasMemberBaseBase562Return of Stack Variable Address
HasMemberVariantVariant563Assignment to Variable without Use
HasMemberVariantVariant564SQL Injection: Hibernate
HasMemberBaseBase565Reliance on Cookies without Validation and Integrity Checking
HasMemberVariantVariant566Authorization Bypass Through User-Controlled SQL Primary Key
HasMemberBaseBase567Unsynchronized Access to Shared Data in a Multithreaded Context
HasMemberVariantVariant568finalize() Method Without super.finalize()
HasMemberCategoryCategory569Expression Issues
HasMemberVariantVariant570Expression is Always False
HasMemberVariantVariant571Expression is Always True
HasMemberVariantVariant572Call to Thread run() instead of start()
HasMemberClassClass573Improper Following of Specification by Caller
HasMemberVariantVariant574EJB Bad Practices: Use of Synchronization Primitives
HasMemberVariantVariant575EJB Bad Practices: Use of AWT Swing
HasMemberVariantVariant576EJB Bad Practices: Use of Java I/O
HasMemberVariantVariant577EJB Bad Practices: Use of Sockets
HasMemberVariantVariant578EJB Bad Practices: Use of Class Loader
HasMemberVariantVariant579J2EE Bad Practices: Non-serializable Object Stored in Session
HasMemberVariantVariant580clone() Method Without super.clone()
HasMemberBaseBase581Object Model Violation: Just One of Equals and Hashcode Defined
HasMemberVariantVariant582Array Declared Public, Final, and Static
HasMemberVariantVariant583finalize() Method Declared Public
HasMemberBaseBase584Return Inside Finally Block
HasMemberVariantVariant585Empty Synchronized Block
HasMemberVariantVariant586Explicit Call to Finalize()
HasMemberBaseBase587Assignment of a Fixed Address to a Pointer
HasMemberVariantVariant588Attempt to Access Child of a Non-structure Pointer
HasMemberVariantVariant589Call to Non-ubiquitous API
HasMemberVariantVariant590Free of Memory not on the Heap
HasMemberVariantVariant591Sensitive Data Storage in Improperly Locked Memory
HasMemberDeprecatedDeprecated592DEPRECATED: Authentication Bypass Issues
HasMemberVariantVariant593Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
HasMemberVariantVariant594J2EE Framework: Saving Unserializable Objects to Disk
HasMemberBaseBase595Comparison of Object References Instead of Object Contents
HasMemberBaseBase596Incorrect Semantic Object Comparison
HasMemberVariantVariant597Use of Wrong Operator in String Comparison
HasMemberVariantVariant598Information Exposure Through Query Strings in GET Request
HasMemberVariantVariant599Missing Validation of OpenSSL Certificate
HasMemberBaseBase600Uncaught Exception in Servlet
HasMemberVariantVariant601URL Redirection to Untrusted Site ('Open Redirect')
HasMemberBaseBase602Client-Side Enforcement of Server-Side Security
HasMemberBaseBase603Use of Client-Side Authentication
HasMemberViewView604Deprecated Entries
HasMemberBaseBase605Multiple Binds to the Same Port
HasMemberBaseBase606Unchecked Input for Loop Condition
HasMemberVariantVariant607Public Static Final Field References Mutable Object
HasMemberVariantVariant608Struts: Non-private Field in ActionForm Class
HasMemberBaseBase609Double-Checked Locking
HasMemberClassClass610Externally Controlled Reference to a Resource in Another Sphere
HasMemberVariantVariant611Improper Restriction of XML External Entity Reference ('XXE')
HasMemberVariantVariant612Information Exposure Through Indexing of Private Data
HasMemberBaseBase613Insufficient Session Expiration
HasMemberVariantVariant614Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
HasMemberVariantVariant615Information Exposure Through Comments
HasMemberVariantVariant616Incomplete Identification of Uploaded File Variables (PHP)
HasMemberVariantVariant617Reachable Assertion
HasMemberBaseBase618Exposed Unsafe ActiveX Method
HasMemberBaseBase619Dangling Database Cursor ('Cursor Injection')
HasMemberVariantVariant620Unverified Password Change
HasMemberBaseBase621Variable Extraction Error
HasMemberVariantVariant622Improper Validation of Function Hook Arguments
HasMemberVariantVariant623Unsafe ActiveX Control Marked Safe For Scripting
HasMemberBaseBase624Executable Regular Expression Error
HasMemberBaseBase625Permissive Regular Expression
HasMemberVariantVariant626Null Byte Interaction Error (Poison Null Byte)
HasMemberBaseBase627Dynamic Variable Evaluation
HasMemberBaseBase628Function Call with Incorrectly Specified Arguments
HasMemberViewView629Weaknesses in OWASP Top Ten (2007)
HasMemberDeprecatedDeprecated630DEPRECATED: Weaknesses Examined by SAMATE
HasMemberDeprecatedDeprecated631DEPRECATED: Resource-specific Weaknesses
HasMemberDeprecatedDeprecated632DEPRECATED: Weaknesses that Affect Files or Directories
HasMemberDeprecatedDeprecated633DEPRECATED: Weaknesses that Affect Memory
HasMemberDeprecatedDeprecated634DEPRECATED: Weaknesses that Affect System Processes
HasMemberViewView635Weaknesses Originally Used by NVD from 2008 to 2016
HasMemberClassClass636Not Failing Securely ('Failing Open')
HasMemberClassClass637Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
HasMemberClassClass638Not Using Complete Mediation
HasMemberBaseBase639Authorization Bypass Through User-Controlled Key
HasMemberBaseBase640Weak Password Recovery Mechanism for Forgotten Password
HasMemberBaseBase641Improper Restriction of Names for Files and Other Resources
HasMemberClassClass642External Control of Critical State Data
HasMemberBaseBase643Improper Neutralization of Data within XPath Expressions ('XPath Injection')
HasMemberVariantVariant644Improper Neutralization of HTTP Headers for Scripting Syntax
HasMemberBaseBase645Overly Restrictive Account Lockout Mechanism
HasMemberVariantVariant646Reliance on File Name or Extension of Externally-Supplied File
HasMemberVariantVariant647Use of Non-Canonical URL Paths for Authorization Decisions
HasMemberBaseBase648Incorrect Use of Privileged APIs
HasMemberBaseBase649Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
HasMemberVariantVariant650Trusting HTTP Permission Methods on the Server Side
HasMemberVariantVariant651Information Exposure Through WSDL File
HasMemberBaseBase652Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
HasMemberBaseBase653Insufficient Compartmentalization
HasMemberBaseBase654Reliance on a Single Factor in a Security Decision
HasMemberBaseBase655Insufficient Psychological Acceptability
HasMemberBaseBase656Reliance on Security Through Obscurity
HasMemberClassClass657Violation of Secure Design Principles
HasMemberViewView658Weaknesses in Software Written in C
HasMemberViewView659Weaknesses in Software Written in C++
HasMemberViewView660Weaknesses in Software Written in Java
HasMemberViewView661Weaknesses in Software Written in PHP
HasMemberBaseBase662Improper Synchronization
HasMemberBaseBase663Use of a Non-reentrant Function in a Concurrent Context
HasMemberClassClass664Improper Control of a Resource Through its Lifetime
HasMemberClassClass665Improper Initialization
HasMemberBaseBase666Operation on Resource in Wrong Phase of Lifetime
HasMemberBaseBase667Improper Locking
HasMemberClassClass668Exposure of Resource to Wrong Sphere
HasMemberClassClass669Incorrect Resource Transfer Between Spheres
HasMemberClassClass670Always-Incorrect Control Flow Implementation
HasMemberClassClass671Lack of Administrator Control over Security
HasMemberBaseBase672Operation on a Resource after Expiration or Release
HasMemberClassClass673External Influence of Sphere Definition
HasMemberBaseBase674Uncontrolled Recursion
HasMemberClassClass675Duplicate Operations on Resource
HasMemberBaseBase676Use of Potentially Dangerous Function
HasMemberViewView677Weakness Base Elements
HasMemberViewView678Composites
HasMemberDeprecatedDeprecated679DEPRECATED: Chain Elements
HasMemberChainChain680Integer Overflow to Buffer Overflow
HasMemberClassClass681Incorrect Conversion between Numeric Types
HasMemberClassClass682Incorrect Calculation
HasMemberVariantVariant683Function Call With Incorrect Order of Arguments
HasMemberClassClass684Incorrect Provision of Specified Functionality
HasMemberVariantVariant685Function Call With Incorrect Number of Arguments
HasMemberVariantVariant686Function Call With Incorrect Argument Type
HasMemberVariantVariant687Function Call With Incorrectly Specified Argument Value
HasMemberVariantVariant688Function Call With Incorrect Variable or Reference as Argument
HasMemberCompositeComposite689Permission Race Condition During Resource Copy
HasMemberChainChain690Unchecked Return Value to NULL Pointer Dereference
HasMemberClassClass691Insufficient Control Flow Management
HasMemberChainChain692Incomplete Blacklist to Cross-Site Scripting
HasMemberClassClass693Protection Mechanism Failure
HasMemberBaseBase694Use of Multiple Resources with Duplicate Identifier
HasMemberBaseBase695Use of Low-Level Functionality
HasMemberClassClass696Incorrect Behavior Order
HasMemberClassClass697Insufficient Comparison
HasMemberBaseBase698Execution After Redirect (EAR)
HasMemberViewView699Development Concepts
HasMemberViewView700Seven Pernicious Kingdoms
HasMemberViewView701Weaknesses Introduced During Design
HasMemberViewView702Weaknesses Introduced During Implementation
HasMemberClassClass703Improper Check or Handling of Exceptional Conditions
HasMemberClassClass704Incorrect Type Conversion or Cast
HasMemberClassClass705Incorrect Control Flow Scoping
HasMemberClassClass706Use of Incorrectly-Resolved Name or Reference
HasMemberClassClass707Improper Enforcement of Message or Data Structure
HasMemberBaseBase708Incorrect Ownership Assignment
HasMemberViewView709Named Chains
HasMemberClassClass710Improper Adherence to Coding Standards
HasMemberViewView711Weaknesses in OWASP Top Ten (2004)
HasMemberCategoryCategory712OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)
HasMemberCategoryCategory713OWASP Top Ten 2007 Category A2 - Injection Flaws
HasMemberCategoryCategory714OWASP Top Ten 2007 Category A3 - Malicious File Execution
HasMemberCategoryCategory715OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference
HasMemberCategoryCategory716OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)
HasMemberCategoryCategory717OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling
HasMemberCategoryCategory718OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management
HasMemberCategoryCategory719OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage
HasMemberCategoryCategory720OWASP Top Ten 2007 Category A9 - Insecure Communications
HasMemberCategoryCategory721OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access
HasMemberCategoryCategory722OWASP Top Ten 2004 Category A1 - Unvalidated Input
HasMemberCategoryCategory723OWASP Top Ten 2004 Category A2 - Broken Access Control
HasMemberCategoryCategory724OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
HasMemberCategoryCategory725OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws
HasMemberCategoryCategory726OWASP Top Ten 2004 Category A5 - Buffer Overflows
HasMemberCategoryCategory727OWASP Top Ten 2004 Category A6 - Injection Flaws
HasMemberCategoryCategory728OWASP Top Ten 2004 Category A7 - Improper Error Handling
HasMemberCategoryCategory729OWASP Top Ten 2004 Category A8 - Insecure Storage
HasMemberCategoryCategory730OWASP Top Ten 2004 Category A9 - Denial of Service
HasMemberCategoryCategory731OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
HasMemberClassClass732Incorrect Permission Assignment for Critical Resource
HasMemberBaseBase733Compiler Optimization Removal or Modification of Security-critical Code
HasMemberViewView734Weaknesses Addressed by the CERT C Secure Coding Standard (2008 Version)
HasMemberCategoryCategory735CERT C Secure Coding (2008 Version) Section 01 - Preprocessor (PRE)
HasMemberCategoryCategory736CERT C Secure Coding (2008 Version) Section 02 - Declarations and Initialization (DCL)
HasMemberCategoryCategory737CERT C Secure Coding (2008 Version) Section 03 - Expressions (EXP)
HasMemberCategoryCategory738CERT C Secure Coding (2008 Version) Section 04 - Integers (INT)
HasMemberCategoryCategory739CERT C Secure Coding (2008 Version) Section 05 - Floating Point (FLP)
HasMemberCategoryCategory740CERT C Secure Coding (2008 Version) Section 06 - Arrays (ARR)
HasMemberCategoryCategory741CERT C Secure Coding (2008 Version) Section 07 - Characters and Strings (STR)
HasMemberCategoryCategory742CERT C Secure Coding (2008 Version) Section 08 - Memory Management (MEM)
HasMemberCategoryCategory743CERT C Secure Coding (2008 Version) Section 09 - Input Output (FIO)
HasMemberCategoryCategory744CERT C Secure Coding (2008 Version) Section 10 - Environment (ENV)
HasMemberCategoryCategory745CERT C Secure Coding (2008 Version) Section 11 - Signals (SIG)
HasMemberCategoryCategory746CERT C Secure Coding (2008 Version) Section 12 - Error Handling (ERR)
HasMemberCategoryCategory747CERT C Secure Coding (2008 Version) Section 49 - Miscellaneous (MSC)
HasMemberCategoryCategory748CERT C Secure Coding (2008 Version) Section 50 - POSIX (POS)
HasMemberBaseBase749Exposed Dangerous Method or Function
HasMemberViewView750Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors
HasMemberCategoryCategory7512009 Top 25 - Insecure Interaction Between Components
HasMemberCategoryCategory7522009 Top 25 - Risky Resource Management
HasMemberCategoryCategory7532009 Top 25 - Porous Defenses
HasMemberClassClass754Improper Check for Unusual or Exceptional Conditions
HasMemberClassClass755Improper Handling of Exceptional Conditions
HasMemberClassClass756Missing Custom Error Page
HasMemberClassClass757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
HasMemberClassClass758Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
HasMemberBaseBase759Use of a One-Way Hash without a Salt
HasMemberBaseBase760Use of a One-Way Hash with a Predictable Salt
HasMemberVariantVariant761Free of Pointer not at Start of Buffer
HasMemberVariantVariant762Mismatched Memory Management Routines
HasMemberBaseBase763Release of Invalid Pointer or Reference
HasMemberVariantVariant764Multiple Locks of a Critical Resource
HasMemberVariantVariant765Multiple Unlocks of a Critical Resource
HasMemberVariantVariant766Critical Variable Declared Public
HasMemberVariantVariant767Access to Critical Private Variable via Public Method
HasMemberVariantVariant768Incorrect Short Circuit Evaluation
HasMemberBaseBase769Uncontrolled File Descriptor Consumption
HasMemberBaseBase770Allocation of Resources Without Limits or Throttling
HasMemberBaseBase771Missing Reference to Active Allocated Resource
HasMemberBaseBase772Missing Release of Resource after Effective Lifetime
HasMemberVariantVariant773Missing Reference to Active File Descriptor or Handle
HasMemberVariantVariant774Allocation of File Descriptors or Handles Without Limits or Throttling
HasMemberVariantVariant775Missing Release of File Descriptor or Handle after Effective Lifetime
HasMemberVariantVariant776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
HasMemberVariantVariant777Regular Expression without Anchors
HasMemberBaseBase778Insufficient Logging
HasMemberBaseBase779Logging of Excessive Data
HasMemberVariantVariant780Use of RSA Algorithm without OAEP
HasMemberVariantVariant781Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
HasMemberVariantVariant782Exposed IOCTL with Insufficient Access Control
HasMemberVariantVariant783Operator Precedence Logic Error
HasMemberVariantVariant784Reliance on Cookies without Validation and Integrity Checking in a Security Decision
HasMemberVariantVariant785Use of Path Manipulation Function without Maximum-sized Buffer
HasMemberBaseBase786Access of Memory Location Before Start of Buffer
HasMemberBaseBase787Out-of-bounds Write
HasMemberBaseBase788Access of Memory Location After End of Buffer
HasMemberVariantVariant789Uncontrolled Memory Allocation
HasMemberClassClass790Improper Filtering of Special Elements
HasMemberBaseBase791Incomplete Filtering of Special Elements
HasMemberVariantVariant792Incomplete Filtering of One or More Instances of Special Elements
HasMemberVariantVariant793Only Filtering One Instance of a Special Element
HasMemberVariantVariant794Incomplete Filtering of Multiple Instances of Special Elements
HasMemberBaseBase795Only Filtering Special Elements at a Specified Location
HasMemberVariantVariant796Only Filtering Special Elements Relative to a Marker
HasMemberVariantVariant797Only Filtering Special Elements at an Absolute Position
HasMemberBaseBase798Use of Hard-coded Credentials
HasMemberClassClass799Improper Control of Interaction Frequency
HasMemberViewView800Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors
HasMemberCategoryCategory8012010 Top 25 - Insecure Interaction Between Components
HasMemberCategoryCategory8022010 Top 25 - Risky Resource Management
HasMemberCategoryCategory8032010 Top 25 - Porous Defenses
HasMemberBaseBase804Guessable CAPTCHA
HasMemberBaseBase805Buffer Access with Incorrect Length Value
HasMemberVariantVariant806Buffer Access Using Size of Source Buffer
HasMemberBaseBase807Reliance on Untrusted Inputs in a Security Decision
HasMemberCategoryCategory8082010 Top 25 - Weaknesses On the Cusp
HasMemberViewView809Weaknesses in OWASP Top Ten (2010)
HasMemberCategoryCategory810OWASP Top Ten 2010 Category A1 - Injection
HasMemberCategoryCategory811OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)
HasMemberCategoryCategory812OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management
HasMemberCategoryCategory813OWASP Top Ten 2010 Category A4 - Insecure Direct Object References
HasMemberCategoryCategory814OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)
HasMemberCategoryCategory815OWASP Top Ten 2010 Category A6 - Security Misconfiguration
HasMemberCategoryCategory816OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage
HasMemberCategoryCategory817OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access
HasMemberCategoryCategory818OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection
HasMemberCategoryCategory819OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards
HasMemberBaseBase820Missing Synchronization
HasMemberBaseBase821Incorrect Synchronization
HasMemberBaseBase822Untrusted Pointer Dereference
HasMemberBaseBase823Use of Out-of-range Pointer Offset
HasMemberBaseBase824Access of Uninitialized Pointer
HasMemberBaseBase825Expired Pointer Dereference
HasMemberBaseBase826Premature Release of Resource During Expected Lifetime
HasMemberBaseBase827Improper Control of Document Type Definition
HasMemberBaseBase828Signal Handler with Functionality that is not Asynchronous-Safe
HasMemberClassClass829Inclusion of Functionality from Untrusted Control Sphere
HasMemberBaseBase830Inclusion of Web Functionality from an Untrusted Source
HasMemberBaseBase831Signal Handler Function Associated with Multiple Signals
HasMemberBaseBase832Unlock of a Resource that is not Locked
HasMemberBaseBase833Deadlock
HasMemberBaseBase834Excessive Iteration
HasMemberBaseBase835Loop with Unreachable Exit Condition ('Infinite Loop')
HasMemberBaseBase836Use of Password Hash Instead of Password for Authentication
HasMemberBaseBase837Improper Enforcement of a Single, Unique Action
HasMemberBaseBase838Inappropriate Encoding for Output Context
HasMemberBaseBase839Numeric Range Comparison Without Minimum Check
HasMemberCategoryCategory840Business Logic Errors
HasMemberBaseBase841Improper Enforcement of Behavioral Workflow
HasMemberBaseBase842Placement of User into Incorrect Group
HasMemberBaseBase843Access of Resource Using Incompatible Type ('Type Confusion')
HasMemberViewView844Weaknesses Addressed by the CERT Java Secure Coding Standard
HasMemberCategoryCategory845CERT Java Secure Coding Section 00 - Input Validation and Data Sanitization (IDS)
HasMemberCategoryCategory846CERT Java Secure Coding Section 01 - Declarations and Initialization (DCL)
HasMemberCategoryCategory847CERT Java Secure Coding Section 02 - Expressions (EXP)
HasMemberCategoryCategory848CERT Java Secure Coding Section 03 - Numeric Types and Operations (NUM)
HasMemberCategoryCategory849CERT Java Secure Coding Section 04 - Object Orientation (OBJ)
HasMemberCategoryCategory850CERT Java Secure Coding Section 05 - Methods (MET)
HasMemberCategoryCategory851CERT Java Secure Coding Section 06 - Exceptional Behavior (ERR)
HasMemberCategoryCategory852CERT Java Secure Coding Section 07 - Visibility and Atomicity (VNA)
HasMemberCategoryCategory853CERT Java Secure Coding Section 08 - Locking (LCK)
HasMemberCategoryCategory854CERT Java Secure Coding Section 09 - Thread APIs (THI)
HasMemberCategoryCategory855CERT Java Secure Coding Section 10 - Thread Pools (TPS)
HasMemberCategoryCategory856CERT Java Secure Coding Section 11 - Thread-Safety Miscellaneous (TSM)
HasMemberCategoryCategory857CERT Java Secure Coding Section 12 - Input Output (FIO)
HasMemberCategoryCategory858CERT Java Secure Coding Section 13 - Serialization (SER)
HasMemberCategoryCategory859CERT Java Secure Coding Section 14 - Platform Security (SEC)
HasMemberCategoryCategory860CERT Java Secure Coding Section 15 - Runtime Environment (ENV)
HasMemberCategoryCategory861CERT Java Secure Coding Section 49 - Miscellaneous (MSC)
HasMemberClassClass862Missing Authorization
HasMemberClassClass863Incorrect Authorization
HasMemberCategoryCategory8642011 Top 25 - Insecure Interaction Between Components
HasMemberCategoryCategory8652011 Top 25 - Risky Resource Management
HasMemberCategoryCategory8662011 Top 25 - Porous Defenses
HasMemberCategoryCategory8672011 Top 25 - Weaknesses On the Cusp
HasMemberViewView868Weaknesses Addressed by the CERT C++ Secure Coding Standard
HasMemberCategoryCategory869CERT C++ Secure Coding Section 01 - Preprocessor (PRE)
HasMemberCategoryCategory870CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL)
HasMemberCategoryCategory871CERT C++ Secure Coding Section 03 - Expressions (EXP)
HasMemberCategoryCategory872CERT C++ Secure Coding Section 04 - Integers (INT)
HasMemberCategoryCategory873CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)
HasMemberCategoryCategory874CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)
HasMemberCategoryCategory875CERT C++ Secure Coding Section 07 - Characters and Strings (STR)
HasMemberCategoryCategory876CERT C++ Secure Coding Section 08 - Memory Management (MEM)
HasMemberCategoryCategory877CERT C++ Secure Coding Section 09 - Input Output (FIO)
HasMemberCategoryCategory878CERT C++ Secure Coding Section 10 - Environment (ENV)
HasMemberCategoryCategory879CERT C++ Secure Coding Section 11 - Signals (SIG)
HasMemberCategoryCategory880CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)
HasMemberCategoryCategory881CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP)
HasMemberCategoryCategory882CERT C++ Secure Coding Section 14 - Concurrency (CON)
HasMemberCategoryCategory883CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)
HasMemberViewView884CWE Cross-section
HasMemberCategoryCategory885SFP Primary Cluster: Risky Values
HasMemberCategoryCategory886SFP Primary Cluster: Unused entities
HasMemberCategoryCategory887SFP Primary Cluster: API
HasMemberViewView888Software Fault Pattern (SFP) Clusters
HasMemberCategoryCategory889SFP Primary Cluster: Exception Management
HasMemberCategoryCategory890SFP Primary Cluster: Memory Access
HasMemberCategoryCategory891SFP Primary Cluster: Memory Management
HasMemberCategoryCategory892SFP Primary Cluster: Resource Management
HasMemberCategoryCategory893SFP Primary Cluster: Path Resolution
HasMemberCategoryCategory894SFP Primary Cluster: Synchronization
HasMemberCategoryCategory895SFP Primary Cluster: Information Leak
HasMemberCategoryCategory896SFP Primary Cluster: Tainted Input
HasMemberCategoryCategory897SFP Primary Cluster: Entry Points
HasMemberCategoryCategory898SFP Primary Cluster: Authentication
HasMemberCategoryCategory899SFP Primary Cluster: Access Control
HasMemberViewView900Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors
HasMemberCategoryCategory901SFP Primary Cluster: Privilege
HasMemberCategoryCategory902SFP Primary Cluster: Channel
HasMemberCategoryCategory903SFP Primary Cluster: Cryptography
HasMemberCategoryCategory904SFP Primary Cluster: Malware
HasMemberCategoryCategory905SFP Primary Cluster: Predictability
HasMemberCategoryCategory906SFP Primary Cluster: UI
HasMemberCategoryCategory907SFP Primary Cluster: Other
HasMemberBaseBase908Use of Uninitialized Resource
HasMemberBaseBase909Missing Initialization of Resource
HasMemberBaseBase910Use of Expired File Descriptor
HasMemberBaseBase911Improper Update of Reference Count
HasMemberClassClass912Hidden Functionality
HasMemberClassClass913Improper Control of Dynamically-Managed Code Resources
HasMemberBaseBase914Improper Control of Dynamically-Identified Variables
HasMemberBaseBase915Improperly Controlled Modification of Dynamically-Determined Object Attributes
HasMemberBaseBase916Use of Password Hash With Insufficient Computational Effort
HasMemberBaseBase917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
HasMemberBaseBase918Server-Side Request Forgery (SSRF)
HasMemberViewView919Weaknesses in Mobile Applications
HasMemberBaseBase920Improper Restriction of Power Consumption
HasMemberBaseBase921Storage of Sensitive Data in a Mechanism without Access Control
HasMemberClassClass922Insecure Storage of Sensitive Information
HasMemberClassClass923Improper Restriction of Communication Channel to Intended Endpoints
HasMemberClassClass924Improper Enforcement of Message Integrity During Transmission in a Communication Channel
HasMemberVariantVariant925Improper Verification of Intent by Broadcast Receiver
HasMemberVariantVariant926Improper Export of Android Application Components
HasMemberVariantVariant927Use of Implicit Intent for Sensitive Communication
HasMemberViewView928Weaknesses in OWASP Top Ten (2013)
HasMemberCategoryCategory929OWASP Top Ten 2013 Category A1 - Injection
HasMemberCategoryCategory930OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management
HasMemberCategoryCategory931OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)
HasMemberCategoryCategory932OWASP Top Ten 2013 Category A4 - Insecure Direct Object References
HasMemberCategoryCategory933OWASP Top Ten 2013 Category A5 - Security Misconfiguration
HasMemberCategoryCategory934OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure
HasMemberCategoryCategory935OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control
HasMemberCategoryCategory936OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF)
HasMemberCategoryCategory937OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
HasMemberCategoryCategory938OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards
HasMemberBaseBase939Improper Authorization in Handler for Custom URL Scheme
HasMemberBaseBase940Improper Verification of Source of a Communication Channel
HasMemberBaseBase941Incorrectly Specified Destination in a Communication Channel
HasMemberVariantVariant942Overly Permissive Cross-domain Whitelist
HasMemberClassClass943Improper Neutralization of Special Elements in Data Query Logic
HasMemberCategoryCategory944SFP Secondary Cluster: Access Management
HasMemberCategoryCategory945SFP Secondary Cluster: Insecure Resource Access
HasMemberCategoryCategory946SFP Secondary Cluster: Insecure Resource Permissions
HasMemberCategoryCategory947SFP Secondary Cluster: Authentication Bypass
HasMemberCategoryCategory948SFP Secondary Cluster: Digital Certificate
HasMemberCategoryCategory949SFP Secondary Cluster: Faulty Endpoint Authentication
HasMemberCategoryCategory950SFP Secondary Cluster: Hardcoded Sensitive Data
HasMemberCategoryCategory951SFP Secondary Cluster: Insecure Authentication Policy
HasMemberCategoryCategory952SFP Secondary Cluster: Missing Authentication
HasMemberCategoryCategory953SFP Secondary Cluster: Missing Endpoint Authentication
HasMemberCategoryCategory954SFP Secondary Cluster: Multiple Binds to the Same Port
HasMemberCategoryCategory955SFP Secondary Cluster: Unrestricted Authentication
HasMemberCategoryCategory956SFP Secondary Cluster: Channel Attack
HasMemberCategoryCategory957SFP Secondary Cluster: Protocol Error
HasMemberCategoryCategory958SFP Secondary Cluster: Broken Cryptography
HasMemberCategoryCategory959SFP Secondary Cluster: Weak Cryptography
HasMemberCategoryCategory960SFP Secondary Cluster: Ambiguous Exception Type
HasMemberCategoryCategory961SFP Secondary Cluster: Incorrect Exception Behavior
HasMemberCategoryCategory962SFP Secondary Cluster: Unchecked Status Condition
HasMemberCategoryCategory963SFP Secondary Cluster: Exposed Data
HasMemberCategoryCategory964SFP Secondary Cluster: Exposure Temporary File
HasMemberCategoryCategory965SFP Secondary Cluster: Insecure Session Management
HasMemberCategoryCategory966SFP Secondary Cluster: Other Exposures
HasMemberCategoryCategory967SFP Secondary Cluster: State Disclosure
HasMemberCategoryCategory968SFP Secondary Cluster: Covert Channel
HasMemberCategoryCategory969SFP Secondary Cluster: Faulty Memory Release
HasMemberCategoryCategory970SFP Secondary Cluster: Faulty Buffer Access
HasMemberCategoryCategory971SFP Secondary Cluster: Faulty Pointer Use
HasMemberCategoryCategory972SFP Secondary Cluster: Faulty String Expansion
HasMemberCategoryCategory973SFP Secondary Cluster: Improper NULL Termination
HasMemberCategoryCategory974SFP Secondary Cluster: Incorrect Buffer Length Computation
HasMemberCategoryCategory975SFP Secondary Cluster: Architecture
HasMemberCategoryCategory976SFP Secondary Cluster: Compiler
HasMemberCategoryCategory977SFP Secondary Cluster: Design
HasMemberCategoryCategory978SFP Secondary Cluster: Implementation
HasMemberCategoryCategory979SFP Secondary Cluster: Failed Chroot Jail
HasMemberCategoryCategory980SFP Secondary Cluster: Link in Resource Name Resolution
HasMemberCategoryCategory981SFP Secondary Cluster: Path Traversal
HasMemberCategoryCategory982SFP Secondary Cluster: Failure to Release Resource
HasMemberCategoryCategory983SFP Secondary Cluster: Faulty Resource Use
HasMemberCategoryCategory984SFP Secondary Cluster: Life Cycle
HasMemberCategoryCategory985SFP Secondary Cluster: Unrestricted Consumption
HasMemberCategoryCategory986SFP Secondary Cluster: Missing Lock
HasMemberCategoryCategory987SFP Secondary Cluster: Multiple Locks/Unlocks
HasMemberCategoryCategory988SFP Secondary Cluster: Race Condition Window
HasMemberCategoryCategory989SFP Secondary Cluster: Unrestricted Lock
HasMemberCategoryCategory990SFP Secondary Cluster: Tainted Input to Command
HasMemberCategoryCategory991SFP Secondary Cluster: Tainted Input to Environment
HasMemberCategoryCategory992SFP Secondary Cluster: Faulty Input Transformation
HasMemberCategoryCategory993SFP Secondary Cluster: Incorrect Input Handling
HasMemberCategoryCategory994SFP Secondary Cluster: Tainted Input to Variable
HasMemberCategoryCategory995SFP Secondary Cluster: Feature
HasMemberCategoryCategory996SFP Secondary Cluster: Security
HasMemberCategoryCategory997SFP Secondary Cluster: Information Loss
HasMemberCategoryCategory998SFP Secondary Cluster: Glitch in Computation
HasMemberViewView999Weaknesses without Software Fault Patterns
HasMemberViewView1000Research Concepts
HasMemberCategoryCategory1001SFP Secondary Cluster: Use of an Improper API
HasMemberCategoryCategory1002SFP Secondary Cluster: Unexpected Entry Points
HasMemberViewView1003Weaknesses for Simplified Mapping of Published Vulnerabilities
HasMemberVariantVariant1004Sensitive Cookie Without 'HttpOnly' Flag
HasMemberCategoryCategory10057PK - Input Validation and Representation
HasMemberCategoryCategory1006Bad Coding Practices
HasMemberBaseBase1007Insufficient Visual Distinction of Homoglyphs Presented to User
HasMemberViewView1008Architectural Concepts
HasMemberCategoryCategory1009Audit
HasMemberCategoryCategory1010Authenticate Actors
HasMemberCategoryCategory1011Authorize Actors
HasMemberCategoryCategory1012Cross Cutting
HasMemberCategoryCategory1013Encrypt Data
HasMemberCategoryCategory1014Identify Actors
HasMemberCategoryCategory1015Limit Access
HasMemberCategoryCategory1016Limit Exposure
HasMemberCategoryCategory1017Lock Computer
HasMemberCategoryCategory1018Manage User Sessions
HasMemberCategoryCategory1019Validate Inputs
HasMemberCategoryCategory1020Verify Message Integrity
HasMemberBaseBase1021Improper Restriction of Rendered UI Layers or Frames
HasMemberVariantVariant1022Improper Restriction of Cross-Origin Permission to window.opener.location
HasMemberViewView2000Comprehensive CWE Dictionary
+ Content History
Modifications
Modification DateModifierOrganizationSource
2008-09-08CWE Content TeamMITRE
updated View_Structure
+ View Metrics
CWEs in this viewTotal CWEs
Total982out of982
Weaknesses714out of 714
Categories237out of 237
Views31out of 31

View Components

A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

CWE-36: Absolute Path Traversal

Weakness ID: 36
Abstraction: Base
Structure: Simple
Status: Draft
Presentation Filter:
+ Description
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
+ Extended Description
This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
Implementation
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

(Language-Independent classes): (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Integrity
Confidentiality
Availability

Technical Impact: Execute Unauthorized Code or Commands

The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity

Technical Impact: Modify Files or Directories

The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality

Technical Impact: Read Files or Directories

The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability

Technical Impact: DoS: Crash, Exit, or Restart

The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the software from working at all and in the case of a protection mechanisms such as authentication, it has the potential to lockout every user of the software.
+ Demonstrative Examples

Example 1

In the example below, the path to a dictionary file is read from a system property and used to initialize a File object.

(bad)
Example Language: Java 
String filename = System.getProperty("com.domain.application.dictionaryFile");
File dictionaryFile = new File(filename);

However, the path is not validated or modified to prevent it from containing absolute path sequences before creating the File object. This allows anyone who can control the system property to determine what file is used. Ideally, the path should be resolved relative to some kind of application or user home directory.

Example 2

The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.

(good)
Example Language: HTML 
<form action="FileUploadServlet" method="post" enctype="multipart/form-data">

Choose a file to upload:
<input type="file" name="filename"/>
<br/>
<input type="submit" name="submit" value="Submit"/>

</form>

When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.

(bad)
Example Language: Java 
public class FileUploadServlet extends HttpServlet {
...

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
response.setContentType("text/html");
PrintWriter out = response.getWriter();
String contentType = request.getContentType();

// the starting position of the boundary header
int ind = contentType.indexOf("boundary=");
String boundary = contentType.substring(ind+9);

String pLine = new String();
String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value

// verify that content type is multipart form data
if (contentType != null && contentType.indexOf("multipart/form-data") != -1) {
// extract the filename from the Http header
BufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));
...
pLine = br.readLine();
String filename = pLine.substring(pLine.lastIndexOf("\\"), pLine.lastIndexOf("\""));
...

// output the file to the local upload directory
try {
BufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));
for (String line; (line=br.readLine())!=null; ) {
if (line.indexOf(boundary) == -1) {
bw.write(line);
bw.newLine();
bw.flush();

}

} //end of for loop
bw.close();


} catch (IOException ex) {...}
// output successful upload response HTML page

}
// output unsuccessful upload response HTML page
else
{...}

}
...

}

As with the previous example this code does not perform a check on the type of the file being uploaded. This could allow an attacker to upload any executable file or other file with malicious code.

Additionally, the creation of the BufferedWriter object is subject to relative path traversal (CWE-22, CWE-23). Depending on the executing environment, the attacker may be able to specify arbitrary files to write to, leading to a wide variety of consequences, from code execution, XSS (CWE-79), or system crash.

+ Observed Examples
ReferenceDescription
Multiple FTP clients write arbitrary files via absolute paths in server responses
ZIP file extractor allows full path
Path traversal using absolute pathname
Path traversal using absolute pathname
Path traversal using absolute pathname
Arbitrary files may be overwritten via compressed attachments that specify absolute path names for the decompressed output.
Mail client allows remote attackers to overwrite arbitrary files via an e-mail message containing a uuencoded attachment that specifies the full pathname for the file to be modified.
Remote attackers can read arbitrary files via a full pathname to the target file in config parameter.
Remote attackers can read arbitrary files via an absolute pathname.
Remote attackers can read arbitrary files by specifying the drive letter in the requested URL.
FTP server allows remote attackers to list arbitrary directories by using the "ls" command and including the drive letter name (e.g. C:) in the requested pathname.
FTP server allows remote attackers to list the contents of arbitrary drives via a ls command that includes the drive letter as an argument.
Server allows remote attackers to browse arbitrary directories via a full pathname in the arguments to certain dynamic pages.
Remote attackers can read arbitrary files via an HTTP request whose argument is a filename of the form "C:" (Drive letter), "//absolute/path", or ".." .
FTP server read/access arbitrary files using "C:\" filenames
FTP server allows a remote attacker to retrieve privileged web server system information by specifying arbitrary paths in the UNC format (\\computername\sharename).
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
NatureTypeIDName
MemberOfViewView884CWE Cross-section
MemberOfCategoryCategory981SFP Secondary Cluster: Path Traversal
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERAbsolute Path Traversal
Software Fault PatternsSFP16Path Traversal
+ References
[REF-62] Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security Assessment". Chapter 9, "Filenames and Paths", Page 503.. 1st Edition. Addison Wesley. 2006.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVER
Modifications
Modification DateModifierOrganizationSource
2008-07-01Sean EidemillerCigital
added/updated demonstrative examples
2008-07-01Eric DalciCigital
updated Time_of_Introduction
2008-09-08CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2008-10-14CWE Content TeamMITRE
updated Description
2010-02-16CWE Content TeamMITRE
updated Demonstrative_Examples
2010-06-21CWE Content TeamMITRE
updated Demonstrative_Examples, Description
2011-06-01CWE Content TeamMITRE
updated Common_Consequences, Relationships, Taxonomy_Mappings
2011-09-13CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2012-05-11CWE Content TeamMITRE
updated Common_Consequences, Demonstrative_Examples, Observed_Examples, References, Relationships
2012-10-30CWE Content TeamMITRE
updated Potential_Mitigations
2014-07-30CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2017-01-19CWE Content TeamMITRE
updated Related_Attack_Patterns
2017-11-08CWE Content TeamMITRE
updated Applicable_Platforms

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Weakness ID: 349
Abstraction: Base
Structure: Simple
Status: Draft
Presentation Filter:
+ Description
The software, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
NatureTypeIDName
ChildOfClassClass345Insufficient Verification of Data Authenticity
+ Relevant to the view "Architectural Concepts" (CWE-1008)
NatureTypeIDName
MemberOfCategoryCategory1019Validate Inputs
+ Relevant to the view "Development Concepts" (CWE-699)
NatureTypeIDName
ChildOfClassClass345Insufficient Verification of Data Authenticity
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and DesignOMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

(Language-Independent classes): (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Access Control
Integrity

Technical Impact: Bypass Protection Mechanism; Modify Application Data

An attacker could package untrusted data with trusted data to bypass protection mechanisms to gain access to and possibly modify sensitive data.
+ Observed Examples
ReferenceDescription
Does not verify that trusted entity is authoritative for all entities in its response.
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERUntrusted Data Appended with Trusted Data
CERT Java Secure CodingENV01-JPlace all security-sensitive code in a single JAR and sign and seal it
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVER
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigital
updated Time_of_Introduction
2008-09-08CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2011-06-01CWE Content TeamMITRE
updated Common_Consequences, Relationships, Taxonomy_Mappings
2012-05-11CWE Content TeamMITRE
updated Common_Consequences, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
2014-07-30CWE Content TeamMITRE
updated Relationships
2017-11-08CWE Content TeamMITRE
updated Applicable_Platforms, Modes_of_Introduction, Relationships
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Untrusted Data Appended with Trusted Data

CWE-788: Access of Memory Location After End of Buffer

Weakness ID: 788
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The software reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
+ Extended Description
This typically occurs when a pointer or its index is decremented to a position before the buffer; when pointer arithmetic results in a position before the buffer; or when a negative index is used, which generates a position before the buffer.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Development Concepts" (CWE-699)
+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Confidentiality

Technical Impact: Read Memory

For an out-of-bounds read, the attacker may have access to sensitive information. If the sensitive information contains system details, such as the current buffers position in memory, this knowledge can be used to craft further attacks, possibly with more severe consequences.
Integrity
Availability

Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart

Out of bounds memory access will very likely result in the corruption of relevant memory, and perhaps instructions, possibly leading to a crash. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

If the memory accessible by the attacker can be effectively controlled, it may be possible to execute arbitrary code, as with a standard buffer overflow. If the attacker can overwrite a pointer's worth of memory (usually 32 or 64 bits), they can redirect a function pointer to their own malicious code. Even when the attacker can only modify a single byte arbitrary code execution can be possible. Sometimes this is because the same problem can be exploited repeatedly to the same effect. Other times it is because the attacker can overwrite security-critical application-specific data -- such as a flag indicating whether the user is an administrator.
+ Demonstrative Examples

Example 1

This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.

(bad)
Example Language:
void host_lookup(char *user_supplied_addr){
struct hostent *hp;
in_addr_t *addr;
char hostname[64];
in_addr_t inet_addr(const char *cp);
/*routine that ensures user_supplied_addr is in the right format for conversion */

validate_addr_form(user_supplied_addr);
addr = inet_addr(user_supplied_addr);
hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);
strcpy(hostname, hp->h_name);

}

This function allocates a buffer of 64 bytes to store the hostname, however there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then we may overwrite sensitive data or even relinquish control flow to the attacker.

Note that this example also contains an unchecked return value (CWE-252) that can lead to a NULL pointer dereference (CWE-476).

Example 2

In the following example, it is possible to request that memcpy move a much larger segment of memory than assumed:

(bad)
Example Language:
int returnChunkSize(void *) {
/* if chunk info is valid, return the size of usable memory,
* else, return -1 to indicate an error
*/
...

}
int main() {
...
memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1));
...

}

If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is not checked before the memcpy operation (CWE-252), so -1 can be passed as the size argument to memcpy() (CWE-805). Because memcpy() assumes that the value is unsigned, it will be interpreted as MAXINT-1 (CWE-195), and therefore will copy far more memory than is likely available to the destination buffer (CWE-787, CWE-788).

Example 3

This example applies an encoding procedure to an input string and stores it into a buffer.

(bad)
Example Language:
char * copy_input(char *user_supplied_string){
int i, dst_index;
char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);
if ( MAX_SIZE <= strlen(user_supplied_string) ){
die("user string too long, die evil hacker!");

}
dst_index = 0;
for ( i = 0; i < strlen(user_supplied_string); i++ ){
if( '&' == user_supplied_string[i] ){
dst_buf[dst_index++] = '&';
dst_buf[dst_index++] = 'a';
dst_buf[dst_index++] = 'm';
dst_buf[dst_index++] = 'p';
dst_buf[dst_index++] = ';';

}
else if ('<' == user_supplied_string[i] ){
/* encode to &lt; */

}
else dst_buf[dst_index++] = user_supplied_string[i];

}
return dst_buf;

}

The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands.

Example 4

In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.

(bad)
Example Language:
int processMessageFromSocket(int socket) {
int success;

char buffer[BUFFER_SIZE];
char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE

if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure

ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing

int index;
for (index = 0; index < msg->msgLength; index++) {
message[index] = msg->msgBody[index];

}
message[index] = '\0';
// process message

success = processMessage(message);

}
return success;

}

However, the message length variable from the structure is used as the condition for ending the for loop without validating that the message length variable accurately reflects the length of message body. This can result in a buffer over read by reading from memory beyond the bounds of the buffer if the message length variable indicates a length that is longer than the size of a message body (CWE-130).

+ Observed Examples
ReferenceDescription
Classic stack-based buffer overflow in media player using a long entry in a playlist
Heap-based buffer overflow in media player using a long entry in a playlist
large precision value in a format string triggers overflow
attacker-controlled array index leads to code execution
OS kernel trusts userland-supplied length value, allowing reading of sensitive information
Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
NatureTypeIDName
MemberOfViewView884CWE Cross-section
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2009-10-21CWE Content TeamMITRE
Modifications
Modification DateModifierOrganizationSource
2011-06-01CWE Content TeamMITRE
updated Common_Consequences
2012-05-11CWE Content TeamMITRE
updated Common_Consequences, Demonstrative_Examples, Observed_Examples, Relationships
2013-02-21CWE Content TeamMITRE
updated Demonstrative_Examples
2014-06-23CWE Content TeamMITRE
updated Demonstrative_Examples
2015-12-07CWE Content TeamMITRE
updated Description
2017-05-03CWE Content TeamMITRE
updated Description
2017-11-08CWE Content TeamMITRE
updated Common_Consequences, Demonstrative_Examples, Observed_Examples

CWE-786: Access of Memory Location Before Start of Buffer

Weakness ID: 786
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The software reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
+ Extended Description
This typically occurs when a pointer or its index is decremented to a position before the buffer, when pointer arithmetic results in a position before the beginning of the valid memory location, or when a negative index is used.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Development Concepts" (CWE-699)
+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Confidentiality

Technical Impact: Read Memory

For an out-of-bounds read, the attacker may have access to sensitive information. If the sensitive information contains system details, such as the current buffers position in memory, this knowledge can be used to craft further attacks, possibly with more severe consequences.
Integrity
Availability

Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart

Out of bounds memory access will very likely result in the corruption of relevant memory, and perhaps instructions, possibly leading to a crash.
Integrity

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code. If the corrupted memory is data rather than instructions, the system will continue to function with improper changes, possibly in violation of an implicit or explicit policy.
+ Demonstrative Examples

Example 1

In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character.

(bad)
Example Language:
char* trimTrailingWhitespace(char *strMessage, int length) {
char *retMessage;
char *message = malloc(sizeof(char)*(length+1));
// copy input string to a temporary string

char message[length+1];
int index;
for (index = 0; index < length; index++) {
message[index] = strMessage[index];

}
message[index] = '\0';
// trim trailing whitespace

int len = index-1;
while (isspace(message[len])) {
message[len] = '\0';
len--;

}
// return string without trailing whitespace

retMessage = message;
return retMessage;

}

However, this function can cause a buffer underwrite if the input character string contains all whitespace. On some systems the while statement will move backwards past the beginning of a character string and will call the isspace() function on an address outside of the bounds of the local buffer.

Example 2

The following example asks a user for an offset into an array to select an item.

(bad)
Example Language:

int main (int argc, char **argv) {
char *items[] = {"boat", "car", "truck", "train"};
int index = GetUntrustedOffset();
printf("You selected %s\n", items[index-1]);

}

The programmer allows the user to specify which element in the list to select, however an attacker can provide an out-of-bounds offset, resulting in a buffer over-read (CWE-126).

Example 3

The following is an example of code that may result in a buffer underwrite, if find() returns a negative value to indicate that ch is not found in srcBuf:

(bad)
Example Language:
int main() {
...
strncpy(destBuf, &srcBuf[find(srcBuf, ch)], 1024);
...

}

If the index to srcBuf is somehow under user control, this is an arbitrary write-what-where condition.

+ Observed Examples
ReferenceDescription
Unchecked length of SSLv2 challenge value leads to buffer underflow.
Buffer underflow from a small size value with a large buffer (length parameter inconsistency, CWE-130)
Buffer underflow from an all-whitespace string, which causes a counter to be decremented before the buffer while looking for a non-whitespace character.
Buffer underflow resultant from encoded data that triggers an integer overflow.
Product sets an incorrect buffer size limit, leading to "off-by-two" buffer underflow.
Negative value is used in a memcpy() operation, leading to buffer underflow.
Buffer underflow due to mishandled special characters
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
NatureTypeIDName
MemberOfViewView884CWE Cross-section
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CERT C Secure CodingARR30-CCWE More SpecificDo not form or use out-of-bounds pointers or array subscripts
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2009-10-21CWE Content TeamMITRE
Modifications
Modification DateModifierOrganizationSource
2011-06-01CWE Content TeamMITRE
updated Common_Consequences
2012-05-11CWE Content TeamMITRE
updated Common_Consequences, Demonstrative_Examples, Observed_Examples, Relationships
2017-11-08CWE Content TeamMITRE
updated Common_Consequences, Demonstrative_Examples, Taxonomy_Mappings

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

Weakness ID: 843
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
+ Extended Description

When the program accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access.

While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways.

This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.

+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Development Concepts" (CWE-699)
NatureTypeIDName
ChildOfClassClass704Incorrect Type Conversion or Cast
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Implementation
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

C: (Undetermined Prevalence)

C++: (Undetermined Prevalence)

+ Alternate Terms
Object Type Confusion
+ Demonstrative Examples

Example 1

The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.

(bad)
Example Language:
#define NAME_TYPE 1
#define ID_TYPE 2

struct MessageBuffer
{
int msgType;
union {
char *name;
int nameID;

};

};


int main (int argc, char **argv) {
struct MessageBuffer buf;
char *defaultMessage = "Hello World";

buf.msgType = NAME_TYPE;
buf.name = defaultMessage;
printf("Pointer of buf.name is %p\n", buf.name);
/* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */

buf.nameID = (int)(defaultMessage + 1);
printf("Pointer of buf.name is now %p\n", buf.name);
if (buf.msgType == NAME_TYPE) {
printf("Message: %s\n", buf.name);

}
else {
printf("Message: Use ID %d\n", buf.nameID);

}

}

The code intends to process the message as a NAME_TYPE, and sets the default message to "Hello World." However, since both buf.name and buf.nameID are part of the same union, they can act as aliases for the same memory location, depending on memory layout after compilation.

As a result, modification of buf.nameID - an int - can effectively modify the pointer that is stored in buf.name - a string.

Execution of the program might generate output such as:

Pointer of name is 10830
Pointer of name is now 10831
Message: ello World

Notice how the pointer for buf.name was changed, even though buf.name was not explicitly modified.

In this case, the first "H" character of the message is omitted. However, if an attacker is able to fully control the value of buf.nameID, then buf.name could contain an arbitrary pointer, leading to out-of-bounds reads or writes.

Example 2

The following PHP code accepts a value, adds 5, and prints the sum.

(bad)
Example Language: PHP 
$value = $_GET['value'];
$sum = $value + 5;
echo "value parameter is '$value'<p>";
echo "SUM is $sum";

When called with the following query string:

value=123

the program calculates the sum and prints out:

SUM is 128

However, the attacker could supply a query string such as:

value[]=123

The "[]" array syntax causes $value to be treated as an array type, which then generates a fatal error when calculating $sum:

Fatal error: Unsupported operand types in program.php on line 2

Example 3

The following Perl code is intended to look up the privileges for user ID's between 0 and 3, by performing an access of the $UserPrivilegeArray reference. It is expected that only userID 3 is an admin (since this is listed in the third element of the array).

(bad)
Example Language: Perl 
my $UserPrivilegeArray = ["user", "user", "admin", "user"];

my $userID = get_current_user_ID();

if ($UserPrivilegeArray eq "user") {
print "Regular user!\n";

}
else {
print "Admin!\n";

}

print "\$UserPrivilegeArray = $UserPrivilegeArray\n";

In this case, the programmer intended to use "$UserPrivilegeArray->{$userID}" to access the proper position in the array. But because the subscript was omitted, the "user" string was compared to the scalar representation of the $UserPrivilegeArray reference, which might be of the form "ARRAY(0x229e8)" or similar.

Since the logic also "fails open" (CWE-636), the result of this bug is that all users are assigned administrator privileges.

While this is a forced example, it demonstrates how type confusion can have security consequences, even in memory-safe languages.

+ Observed Examples
ReferenceDescription
Type confusion in CSS sequence leads to out-of-bounds read.
Size inconsistency allows code execution, first discovered when it was actively exploited in-the-wild.
Improperly-parsed file containing records of different types leads to code execution when a memory location is interpreted as a different object than intended.
+ Notes

Applicable Platform

This weakness is possible in any type-unsafe programming language.

Research Gap

Type confusion weaknesses have received some attention by applied researchers and major software vendors for C and C++ code. Some publicly-reported vulnerabilities probably have type confusion as a root-cause weakness, but these may be described as "memory corruption" instead. This weakness seems likely to gain prominence in upcoming years.

For other languages, there are very few public reports of type confusion weaknesses. These are probably under-studied. Since many programs rely directly or indirectly on loose typing, a potential "type confusion" behavior might be intentional, possibly requiring more manual analysis.

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CERT C Secure CodingEXP39-CExactDo not access a variable through a pointer of an incompatible type
+ References
[REF-811] Mark Dowd, Ryan Smith and David Dewey. "Attacking Interoperability". "Type Confusion Vulnerabilities," page 59. 2009. <http://www.azimuthsecurity.com/resources/bh2009_dowd_smith_dewey.pdf>.
[REF-62] Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security Assessment". Chapter 7, "Type Confusion", Page 319.. 1st Edition. Addison Wesley. 2006.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2011-05-15CWE Content TeamMITRE
Modifications
Modification DateModifierOrganizationSource
2012-05-11CWE Content TeamMITRE
updated References
2017-11-08CWE Content TeamMITRE
updated Applicable_Platforms, Taxonomy_Mappings

CWE-824: Access of Uninitialized Pointer

Weakness ID: 824
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The program accesses or uses a pointer that has not been initialized.
+ Extended Description

If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the program to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.

Depending on memory layout, associated memory management behaviors, and program operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.

+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (CWE-1003)
+ Relevant to the view "Development Concepts" (CWE-699)
+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Confidentiality

Technical Impact: Read Memory

If the uninitialized pointer is used in a read operation, an attacker might be able to read sensitive portions of memory.
Availability

Technical Impact: DoS: Crash, Exit, or Restart

If the uninitialized pointer references a memory location that is not accessible to the program, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity
Confidentiality
Availability

Technical Impact: Execute Unauthorized Code or Commands

If the uninitialized pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
+ Observed Examples
ReferenceDescription
chain: unchecked return value (CWE-252) leads to free of invalid, uninitialized pointer (CWE-824).
Pointer in structure is not initialized, leading to NULL pointer dereference (CWE-476) and system crash.
Free of an uninitialized pointer.
Improper handling of invalid signatures leads to free of invalid pointer.
Invalid encoding triggers free of uninitialized pointer.
Crafted PNG image leads to free of uninitialized pointer.
Crafted GIF image leads to free of uninitialized pointer.
Access of uninitialized pointer might lead to code execution.
Step-based manipulation: invocation of debugging function before the primary initialization function leads to access of an uninitialized pointer and code execution.
Unchecked return values can lead to a write to an uninitialized pointer.
zero-length input leads to free of uninitialized pointer.
Crafted font leads to uninitialized function pointer.
Uninitialized function pointer in freed memory is invoked
LDAP server mishandles malformed BER queries, leading to free of uninitialized memory
Firewall can crash with certain ICMP packets that trigger access of an uninitialized pointer.
LDAP server does not initialize members of structs, which leads to free of uninitialized pointer if an LDAP request fails.
+ Notes

Maintenance

There are close relationships between incorrect pointer dereferences and other weaknesses related to buffer operations. There may not be sufficient community agreement regarding these relationships. Further study is needed to determine when these relationships are chains, composites, perspective/layering, or other types of relationships. As of September 2010, most of the relationships are being captured as chains.

Research Gap

Under-studied and probably under-reported as of September 2010. This weakness has been reported in high-visibility software, but applied vulnerability researchers have only been investigating it since approximately 2008, and there are only a few public reports. Few reports identify weaknesses at such a low level, which makes it more difficult to find and study real-world code examples.

Terminology

Many weaknesses related to pointer dereferences fall under the general term of "memory corruption" or "memory safety." As of September 2010, there is no commonly-used terminology that covers the lower-level variants.
+ References
[REF-62] Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security Assessment". Chapter 7, "Variable Initialization", Page 312.. 1st Edition. Addison Wesley. 2006.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2010-09-22CWE Content TeamMITRE
Modifications
Modification DateModifierOrganizationSource
2012-05-11CWE Content TeamMITRE
updated References
2015-12-07CWE Content TeamMITRE
updated Relationships

CWE-767: Access to Critical Private Variable via Public Method

Weakness ID: 767
Abstraction: Variant
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The software defines a public method that reads or modifies a private variable.
+ Extended Description
If an attacker modifies the variable to contain unexpected values, this could violate assumptions from other parts of the code. Additionally, if an attacker can read the private variable, it may expose sensitive information or make it easier to launch further attacks.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
NatureTypeIDName
ChildOfClassClass668Exposure of Resource to Wrong Sphere
+ Relevant to the view "Development Concepts" (CWE-699)
NatureTypeIDName
MemberOfCategoryCategory265Privilege / Sandbox Issues
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
Implementation
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

C++: (Undetermined Prevalence)

C#: (Undetermined Prevalence)

Java: (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Integrity
Other

Technical Impact: Modify Application Data; Other

+ Demonstrative Examples

Example 1

The following example declares a critical variable to be private, and then allows the variable to be modified by public methods.

(bad)
Example Language: C++ 
private: float price;
public: void changePrice(float newPrice) {
price = newPrice;

}

Example 2

The following example could be used to implement a user forum where a single user (UID) can switch between multiple profiles (PID).

(bad)
Example Language: Java 
public class Client {
private int UID;
public int PID;
private String userName;
public Client(String userName){
PID = getDefaultProfileID();
UID = mapUserNametoUID( userName );
this.userName = userName;

}
public void setPID(int ID) {
UID = ID;

}

}

The programmer implemented setPID with the intention of modifying the PID variable, but due to a typo. accidentally specified the critical variable UID instead. If the program allows profile IDs to be between 1 and 10, but a UID of 1 means the user is treated as an admin, then a user could gain administrative privileges as a result of this typo.

+ Potential Mitigations

Phase: Implementation

Use class accessor and mutator methods appropriately. Perform validation when accepting data from a public method that is intended to modify a critical private variable. Also be sure that appropriate access controls are being applied when a public method interfaces with critical data.
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
NatureTypeIDName
MemberOfCategoryCategory963SFP Secondary Cluster: Exposed Data
+ Notes

Maintenance

This entry is closely associated with access control for public methods. If the public methods are restricted with proper access controls, then the information in the private variable will not be exposed to unexpected parties. There may be chaining or composite relationships between improper access controls and this weakness.
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CLASPFailure to protect stored data from modification
Software Fault PatternsSFP23Exposed Data
CERT Perl Secure CodingOOP31-PLImpreciseDo not access private variables or subroutines in other packages
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2009-03-03CWE Content TeamMITRE
Modifications
Modification DateModifierOrganizationSource
2011-06-01CWE Content TeamMITRE
updated Common_Consequences
2012-05-11CWE Content TeamMITRE
updated Relationships
2014-07-30CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2017-11-08CWE Content TeamMITRE
updated Likelihood_of_Exploit, Relationships, Taxonomy_Mappings

CWE-464: Addition of Data Structure Sentinel

Weakness ID: 464
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The accidental addition of a data-structure sentinel can cause serious programming logic problems.
+ Extended Description
Data-structure sentinels are often used to mark the structure of data. A common example of this is the null character at the end of strings or a special sentinel to mark the end of a linked list. It is dangerous to allow this type of control data to be easily accessible. Therefore, it is important to protect from the addition or modification of sentinels.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Development Concepts" (CWE-699)
NatureTypeIDName
MemberOfCategoryCategory461Data Structure Issues
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
Implementation
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

C: (Undetermined Prevalence)

C++: (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Integrity

Technical Impact: Modify Application Data

Generally this error will cause the data structure to not work properly by truncating the data.
+ Likelihood Of Exploit
High
+ Demonstrative Examples

Example 1

The following example assigns some character values to a list of characters and prints them each individually, and then as a string. The third character value is intended to be an integer taken from user input and converted to an int.

(bad)
Example Language:
char *foo;
foo=malloc(sizeof(char)*5);
foo[0]='a';
foo[1]='a';
foo[2]=atoi(getc(stdin));
foo[3]='c';
foo[4]='\0'
printf("%c %c %c %c %c \n",foo[0],foo[1],foo[2],foo[3],foo[4]);
printf("%s\n",foo);

The first print statement will print each character separated by a space. However, if a non-integer is read from stdin by getc, then atoi will not make a conversion and return 0. When foo is printed as a string, the 0 at character foo[2] will act as a NULL terminator and foo[3] will never be printed.

+ Potential Mitigations

Phases: Implementation; Architecture and Design

Encapsulate the user from interacting with data sentinels. Validate user input to verify that sentinels are not present.

Phase: Implementation

Proper error checking can reduce the risk of inadvertently introducing sentinel values into data. For example, if a parsing function fails or encounters an error, it might return a value that is the same as the sentinel.

Phase: Architecture and Design

Use an abstraction library to abstract away risky APIs. This is not a complete solution.

Phase: Operation

Use OS-level preventative functionality. This is not a complete solution.
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CLASPAddition of data-structure sentinel
CERT C Secure CodingSTR03-CDo not inadvertently truncate a null-terminated byte string
CERT C Secure CodingSTR06-CDo not assume that strtok() leaves the parse string unchanged
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
CLASP
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigital
updated Time_of_Introduction
2008-09-08CWE Content TeamMITRE
updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
2008-11-24CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2009-07-27CWE Content TeamMITRE
updated Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Relationships
2011-06-01CWE Content TeamMITRE
updated Common_Consequences
2011-06-27CWE Content TeamMITRE
updated Common_Consequences
2011-09-13CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2012-05-11CWE Content TeamMITRE
updated Relationships
2012-10-30CWE Content TeamMITRE
updated Potential_Mitigations
2014-07-30CWE Content TeamMITRE
updated Relationships
2017-11-08CWE Content TeamMITRE
updated Demonstrative_Examples, Likelihood_of_Exploit, Taxonomy_Mappings
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Addition of Data-structure Sentinel

CWE-407: Algorithmic Complexity

Weakness ID: 407
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (CWE-1003)
+ Relevant to the view "Development Concepts" (CWE-699)
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
Implementation
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

(Language-Independent classes): (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Availability

Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)

The typical consequence is CPU consumption, but memory consumption and consumption of other resources can also occur.
+ Likelihood Of Exploit
Low
+ Observed Examples
ReferenceDescription
CPU consumption via inputs that cause many hash table collisions.
CPU consumption via inputs that cause many hash table collisions.
Product performs unnecessary processing before dropping an invalid packet.
CPU and memory consumption using many wildcards.
Product allows attackers to cause multiple copies of a program to be loaded more quickly than the program can detect that other copies are running, then exit. This type of error should probably have its own category, where teardown takes more time than initialization.
Network monitoring system allows remote attackers to cause a denial of service (CPU consumption and detection outage) via crafted network traffic, aka a "backtracking attack."
Wiki allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case algorithmic complexity.
Wiki allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case algorithmic complexity.
OS allows attackers to cause a denial of service (CPU consumption) via crafted Gregorian dates.
Memory leak by performing actions faster than the software can clear them.
+ Functional Areas
  • Cryptography
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
NatureTypeIDName
MemberOfViewView884CWE Cross-section
MemberOfCategoryCategory977SFP Secondary Cluster: Design
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERAlgorithmic Complexity
+ References
[REF-395] Crosby and Wallach. "Algorithmic Complexity Attacks". <http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003/index.html>.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVER
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigital
updated Time_of_Introduction
2008-09-08CWE Content TeamMITRE
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
2009-07-27CWE Content TeamMITRE
updated Functional_Areas, Other_Notes
2009-10-29CWE Content TeamMITRE
updated Common_Consequences
2009-12-28CWE Content TeamMITRE
updated Applicable_Platforms, Likelihood_of_Exploit
2011-06-01CWE Content TeamMITRE
updated Common_Consequences
2012-05-11CWE Content TeamMITRE
updated Observed_Examples, Relationships
2014-07-30CWE Content TeamMITRE
updated Relationships
2015-12-07CWE Content TeamMITRE
updated Relationships
2017-11-08CWE Content TeamMITRE
updated Likelihood_of_Exploit

CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling

Weakness ID: 774
Abstraction: Variant
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The software allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor.
+ Extended Description
This can cause the software to consume all available file descriptors or handles, which can prevent other processes from performing critical file processing operations.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (CWE-1003)
NatureTypeIDName
ChildOfBaseBase769Uncontrolled File Descriptor Consumption
+ Relevant to the view "Development Concepts" (CWE-699)
NatureTypeIDName
ChildOfBaseBase769Uncontrolled File Descriptor Consumption
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
Implementation
+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Availability

Technical Impact: DoS: Resource Consumption (Other)

When allocating resources without limits, an attacker could prevent all other processes from accessing the same type of resource.
+ Likelihood Of Exploit
Low
+ Potential Mitigations

Phases: Operation; Architecture and Design

Strategy: Resource Limitation

Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available. However, these functions are not available on all operating systems. When the current levels get close to the maximum that is defined for the application (see CWE-770), then limit the allocation of further resources to privileged users; alternately, begin releasing resources for less-privileged users. While this mitigation may protect the system from attack, it will not necessarily stop attackers from adversely impacting other users. Ensure that the application performs the appropriate error checks and error handling in case resources become unavailable (CWE-703).
+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
NatureTypeIDName
MemberOfCategoryCategory985SFP Secondary Cluster: Unrestricted Consumption
+ Notes

Theoretical

Vulnerability theory is largely about how behaviors and resources interact. "Resource exhaustion" can be regarded as either a consequence or an attack, depending on the perspective. This entry is an attempt to reflect one of the underlying weaknesses that enable these attacks (or consequences) to take place.
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
Software Fault PatternsSFP13Unrestricted Consumption
+ References
[REF-62] Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security Assessment". Chapter 10, "Resource Limits", Page 574.. 1st Edition. Addison Wesley. 2006.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2009-05-13CWE Content TeamMITRE
Modifications
Modification DateModifierOrganizationSource
2010-04-05CWE Content TeamMITRE
updated Potential_Mitigations
2011-06-01CWE Content TeamMITRE
updated Common_Consequences
2012-05-11CWE Content TeamMITRE
updated References, Relationships
2012-10-30CWE Content TeamMITRE
updated Potential_Mitigations
2014-07-30CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2015-12-07CWE Content TeamMITRE
updated Relationships
2017-11-08CWE Content TeamMITRE
updated Likelihood_of_Exploit, Relationships

CWE-770: Allocation of Resources Without Limits or Throttling

Weakness ID: 770
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy for that actor.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Architectural Concepts" (CWE-1008)
NatureTypeIDName
MemberOfCategoryCategory1011Authorize Actors
+ Relevant to the view "Development Concepts" (CWE-699)
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and DesignOMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation
Operation
System Configuration
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

(Language-Independent classes): (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Availability

Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)

When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource.
+ Likelihood Of Exploit
High
+ Demonstrative Examples

Example 1

This code allocates a socket and forks each time it receives a new connection.

(bad)
Example Language:
sock=socket(AF_INET, SOCK_STREAM, 0);
while (1) {
newsock=accept(sock, ...);
printf("A connection has been accepted\n");
pid = fork();

}

The program does not track how many connections have been made, and it does not limit the number of connections. Because forking is a relatively expensive operation, an attacker would be able to cause the system to run out of CPU, processes, or memory by making a large number of connections. Alternatively, an attacker could consume all available connections, preventing others from accessing the system remotely.

Example 2

In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the data, the openFileToWrite method will validate the filename and open a file to write to on the local file system. The getNextMessage is then used within a while loop to continuously read data from the socket and output the data to the file until there is no longer any data from the socket.

(bad)
Example Language:
int writeDataFromSocketToFile(char *host, int port)
{

char filename[FILENAME_SIZE];
char buffer[BUFFER_SIZE];
int socket = openSocketConnection(host, port);

if (socket < 0) {
printf("Unable to open socket connection");
return(FAIL);

}
if (getNextMessage(socket, filename, FILENAME_SIZE) > 0) {
if (openFileToWrite(filename) > 0) {
while (getNextMessage(socket, buffer, BUFFER_SIZE) > 0){
if (!(writeToFile(buffer) > 0))
break;

}

}
closeFile();

}
closeSocket(socket);

}

This example creates a situation where data can be dumped to a file on the local file system without any limits on the size of the file. This could potentially exhaust file or disk resources and/or limit other clients' ability to access the service.

Example 3

In the following example, the processMessage method receives a two dimensional character array containing the message to be processed. The two-dimensional character array contains the length of the message in the first character array and the message body in the second character array. The getMessageLength method retrieves the integer value of the length from the first character array. After validating that the message length is greater than zero, the body character array pointer points to the start of the second character array of the two-dimensional character array and memory is allocated for the new body character array.

(bad)
Example Language:
/* process message accepts a two-dimensional character array of the form [length][body] containing the message to be processed */
int processMessage(char **message)
{
char *body;

int length = getMessageLength(message[0]);

if (length > 0) {
body = &message[1][0];
processMessageBody(body);
return(SUCCESS);

}
else {
printf("Unable to process message; invalid message length");
return(FAIL);

}

}

This example creates a situation where the length of the body character array can be very large and will consume excessive memory, exhausting system resources. This can be avoided by restricting the length of the second character array with a maximum length check

Also, consider changing the type from 'int' to 'unsigned int', so that you are always guaranteed that the number is positive. This might not be possible if the protocol specifically requires allowing negative values, or if you cannot control the return value from getMessageLength(), but it could simplify the check to ensure the input is positive, and eliminate other errors such as signed-to-unsigned conversion errors (CWE-195) that may occur elsewhere in the code.

(good)
Example Language:
unsigned int length = getMessageLength(message[0]);
if ((length > 0) && (length < MAX_LENGTH)) {...}

Example 4

In the following example, a server object creates a server socket and accepts client connections to the socket. For every client connection to the socket a separate thread object is generated using the ClientSocketThread class that handles request made by the client through the socket.

(bad)
Example Language: Java 
public void acceptConnections() {
try {
ServerSocket serverSocket = new ServerSocket(SERVER_PORT);
int counter = 0;
boolean hasConnections = true;
while (hasConnections) {
Socket client = serverSocket.accept();
Thread t = new Thread(new ClientSocketThread(client));
t.setName(client.getInetAddress().getHostName() + ":" + counter++);
t.start();

}
serverSocket.close();


} catch (IOException ex) {...}

}

In this example there is no limit to the number of client connections and client threads that are created. Allowing an unlimited number of client connections and threads could potentially overwhelm the system and system resources.

The server should limit the number of client connections and the client threads that are created. This can be easily done by creating a thread pool object that limits the number of threads that are generated.

(good)
Example Language: Java 
public static final int SERVER_PORT = 4444;
public static final int MAX_CONNECTIONS = 10;
...

public void acceptConnections() {
try {
ServerSocket serverSocket = new ServerSocket(SERVER_PORT);
int counter = 0;
boolean hasConnections = true;
while (hasConnections) {
hasConnections = checkForMoreConnections();
Socket client = serverSocket.accept();
Thread t = new Thread(new ClientSocketThread(client));
t.setName(client.getInetAddress().getHostName() + ":" + counter++);
ExecutorService pool = Executors.newFixedThreadPool(MAX_CONNECTIONS);
pool.execute(t);

}
serverSocket.close();


} catch (IOException ex) {...}

}

Example 5

An unnamed web site allowed a user to purchase tickets for an event. A menu option allowed the user to purchase up to 10 tickets, but the back end did not restrict the actual number of tickets that could be purchased.

Example 5 References:

[REF-667] Rafal Los. "Real-Life Example of a 'Business Logic Defect' (Screen Shots!)". 2011. <http://h30501.www3.hp.com/t5/Following-the-White-Rabbit-A/Real-Life-Example-of-a-Business-Logic-Defect-Screen-Shots/ba-p/22581>.
+ Observed Examples
ReferenceDescription
Language interpreter does not restrict the number of temporary files being created when handling a MIME request with a large number of parts..
Driver does not use a maximum width when invoking sscanf style functions, causing stack consumption.
Large integer value for a length property in an object causes a large amount of memory allocation.
Product allows exhaustion of file descriptors when processing a large number of TCP packets.
Communication product allows memory consumption with a large number of SIP requests, which cause many sessions to be created.
Product allows attackers to cause a denial of service via a large number of directives, each of which opens a separate window.
CMS does not restrict the number of searches that can occur simultaneously, leading to resource exhaustion.
+ Potential Mitigations

Phase: Requirements

Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

Phase: Architecture and Design

Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Phase: Architecture and Design

Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place, and it will help the administrator to identify who is committing the abuse. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.

Phase: Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). A blacklist is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
This will only be applicable to cases where user input can influence the size or frequency of resource allocations.

Phase: Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Phase: Architecture and Design

Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, typically by using increasing time delays uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution can be difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply requires more resources on the part of the attacker.

Phase: Architecture and Design

Ensure that protocols have specific limits of scale placed on them.

Phases: Architecture and Design; Implementation

If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery. Ensure that all failures in resource allocation place the system into a safe posture.

Phases: Operation; Architecture and Design

Strategy: Resource Limitation

Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available. However, these functions are not available on all operating systems. When the current levels get close to the maximum that is defined for the application (see CWE-770), then limit the allocation of further resources to privileged users; alternately, begin releasing resources for less-privileged users. While this mitigation may protect the system from attack, it will not necessarily stop attackers from adversely impacting other users. Ensure that the application performs the appropriate error checks and error handling in case resources become unavailable (CWE-703).
+ Detection Methods

Manual Static Analysis

Manual static analysis can be useful for finding this weakness, but it might not achieve desired code coverage within limited time constraints. If denial-of-service is not considered a significant risk, or if there is strong emphasis on consequences such as code execution, then manual analysis may not focus on this weakness at all.

Fuzzing

While fuzzing is typically geared toward finding low-level implementation bugs, it can inadvertently find uncontrolled resource allocation problems. This can occur when the fuzzer generates a large number of test cases but does not restart the targeted software in between test cases. If an individual test case produces a crash, but it does not do so reliably, then an inability to limit resource allocation may be the cause.

When the allocation is directly affected by numeric inputs, then fuzzing may produce indications of this weakness.

Effectiveness: Opportunistic

Automated Dynamic Analysis

Certain automated dynamic analysis techniques may be effective in producing side effects of uncontrolled resource allocation problems, especially with resources such as processes, memory, and connections. The technique may involve generating a large number of requests to the software within a short time frame. Manual analysis is likely required to interpret the results.

Automated Static Analysis

Specialized configuration or tuning may be required to train automated tools to recognize this weakness.

Automated static analysis typically has limited utility in recognizing unlimited allocation problems, except for the missing release of program-independent system resources such as files, sockets, and processes, or unchecked arguments to memory. For system resources, automated static analysis may be able to detect circumstances in which resources are not released after they have expired, or if too much of a resource is requested at once, as can occur with memory. Automated analysis of configuration files may be able to detect settings that do not specify a maximum value.

Automated static analysis tools will not be appropriate for detecting exhaustion of custom resources, such as an intended security policy in which a bulletin board user is only allowed to make a limited number of posts per day.

+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
+ Notes

Maintenance

"Resource exhaustion" (CWE-400) is currently treated as a weakness, although it is more like a category of weaknesses that all have the same type of consequence. While this entry treats CWE-400 as a parent in view 1000, the relationship is probably more appropriately described as a chain.

Theoretical

Vulnerability theory is largely about how behaviors and resources interact. "Resource exhaustion" can be regarded as either a consequence or an attack, depending on the perspective. This entry is an attempt to reflect one of the underlying weaknesses that enable these attacks (or consequences) to take place.
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CERT Java Secure CodingFIO04-JClose resources when they are no longer needed
CERT Java Secure CodingSER12-JAvoid memory and resource leaks during serialization
CERT Java Secure CodingMSC05-JDo not exhaust heap space
+ References
[REF-386] Joao Antunes, Nuno Ferreira Neves and Paulo Verissimo. "Detection and Prediction of Resource-Exhaustion Vulnerabilities". Proceedings of the IEEE International Symposium on Software Reliability Engineering (ISSRE). 2008-11. <http://homepages.di.fc.ul.pt/~nuno/PAPERS/ISSRE08.pdf>.
[REF-387] D.J. Bernstein. "Resource exhaustion". <http://cr.yp.to/docs/resources.html>.
[REF-388] Pascal Meunier. "Resource exhaustion". Secure Programming Educational Material. 2004. <http://homes.cerias.purdue.edu/~pmeunier/secprog/sanitized/class1/6.resource%20exhaustion.ppt>.
[REF-7] Michael Howard and David LeBlanc. "Writing Secure Code". Chapter 17, "Protecting Against Denial of Service Attacks" Page 517. 2nd Edition. Microsoft Press. 2002-12-04. <https://www.microsoft.com/mspress/books/toc/5957.aspx>.
[REF-672] Frank Kim. "Top 25 Series - Rank 22 - Allocation of Resources Without Limits or Throttling". SANS Software Security Institute. 2010-03-23. <http://blogs.sans.org/appsecstreetfighter/2010/03/23/top-25-series-rank-22-allocation-of-resources-without-limits-or-throttling/>.
[REF-62] Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security Assessment". Chapter 10, "Resource Limits", Page 574.. 1st Edition. Addison Wesley. 2006.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2009-05-13CWE Content TeamMITRE
Modifications
Modification DateModifierOrganizationSource
2009-07-27CWE Content TeamMITRE
updated Related_Attack_Patterns
2009-10-29CWE Content TeamMITRE
updated Relationships
2009-12-28CWE Content TeamMITRE
updated Applicable_Platforms, Demonstrative_Examples, Detection_Factors, Observed_Examples, References, Time_of_Introduction
2010-02-16CWE Content TeamMITRE
updated Common_Consequences, Detection_Factors, Potential_Mitigations, References, Related_Attack_Patterns, Relationships
2010-04-05CWE Content TeamMITRE
updated Common_Consequences, Demonstrative_Examples, Related_Attack_Patterns
2010-06-21CWE Content TeamMITRE
updated Common_Consequences, Potential_Mitigations, References
2010-09-27CWE Content TeamMITRE
updated Demonstrative_Examples, Potential_Mitigations
2011-03-29CWE Content TeamMITRE
updated Demonstrative_Examples, Detection_Factors, Relationships
2011-06-01CWE Content TeamMITRE
updated Common_Consequences, Relationships, Taxonomy_Mappings
2011-06-27CWE Content TeamMITRE
updated Relationships
2011-09-13CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2012-05-11CWE Content TeamMITRE
updated Demonstrative_Examples, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
2012-10-30CWE Content TeamMITRE
updated Potential_Mitigations
2014-02-18CWE Content TeamMITRE
updated Related_Attack_Patterns
2014-06-23CWE Content TeamMITRE
updated Related_Attack_Patterns
2014-07-30CWE Content TeamMITRE
updated Relationships
2015-12-07CWE Content TeamMITRE
updated Related_Attack_Patterns
2017-05-03CWE Content TeamMITRE
updated Related_Attack_Patterns
2017-11-08CWE Content TeamMITRE
updated Demonstrative_Examples, Likelihood_of_Exploit, Modes_of_Introduction, Potential_Mitigations, References, Relationships, Taxonomy_Mappings

CWE-670: Always-Incorrect Control Flow Implementation

Weakness ID: 670
Abstraction: Class
Structure: Simple
Status: Draft
Presentation Filter:
+ Description
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
+ Extended Description
This weakness captures cases in which a particular code segment is always incorrect with respect to the algorithm that it is implementing. For example, if a C programmer intends to include multiple statements in a single block but does not include the enclosing braces (CWE-483), then the logic is always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves correctly, except when it is externally manipulated in malicious ways.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Development Concepts" (CWE-699)
NatureTypeIDName
MemberOfCategoryCategory438Behavioral Problems
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
ImplementationThis issue typically appears in rarely-tested code, since the "always-incorrect" nature will be detected as a bug during normal usage.
Operation
+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Other

Technical Impact: Other; Alter Execution Logic

+ Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
NatureTypeIDName
MemberOfCategoryCategory977SFP Secondary Cluster: Design
+ Notes

Maintenance

This node could possibly be split into lower-level nodes. "Early Return" is for returning control to the caller too soon (e.g., CWE-584). "Excess Return" is when control is returned too far up the call stack (CWE-600, CWE-395). "Improper control limitation" occurs when the product maintains control at a lower level of execution, when control should be returned "further" up the call stack (CWE-455). "Incorrect syntax" covers code that's "just plain wrong" such as CWE-484 and CWE-483.
+ Content History
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigital
updated Time_of_Introduction
2008-09-08CWE Content TeamMITRE
updated Description, Relationships, Other_Notes
2009-07-27CWE Content TeamMITRE
updated Maintenance_Notes, Modes_of_Introduction, Other_Notes, Relationships
2011-06-01CWE Content TeamMITRE
updated Common_Consequences, Relationships, Taxonomy_Mappings
2012-05-11CWE Content TeamMITRE
updated Relationships, Taxonomy_Mappings
2014-07-30CWE Content TeamMITRE
updated Relationships
2017-01-19CWE Content TeamMITRE
updated Relationships
2017-11-08CWE Content TeamMITRE
updated Relationships

CWE VIEW: Architectural Concepts

View ID: 1008
Type: Graph
Status: Incomplete
+ Objective
This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential weaknesses when designing software. The top level categories in this view represent the individual tactics that are part of a secure-by-design approach to software development. The weaknesses that are members of each category contain information about how each is introduced relative to the software's architecture. Three different modes of introduction are used: Omission - caused by missing a security tactic when it is necessary. Commission - refers to incorrect choice of tactics which could result in undesirable consequences. Realization - appropriate security tactics are adopted but are incorrectly implemented.
+ Audience
StakeholderDescription
Software DesignersSoftware designers may find this view useful as the weaknesses are organized by known security tactics, aiding the designer in imbedding security throughout the design process instead of discovering weaknesses after the software has been built.
EducatorsSince Architectural Concepts covers weaknesses based on security tactics, educators may use this view as reference material when discussing security by design or architectural weaknesses.
+ Relationships
Show Details:
1008 - Architectural Concepts
+CategoryCategoryAudit - (1009)
1008 (Architectural Concepts) > 1009 (Audit)
Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.
*BaseBaseImproper Output Neutralization for Logs - (117)
1008 (Architectural Concepts) > 1009 (Audit) > 117 (Improper Output Neutralization for Logs)
The software does not neutralize or incorrectly neutralizes output that is written to logs.
*BaseBaseOmission of Security-relevant Information - (223)
1008 (Architectural Concepts) > 1009 (Audit) > 223 (Omission of Security-relevant Information)
The application does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
*BaseBaseObscured Security-relevant Information by Alternate Name - (224)
1008 (Architectural Concepts) > 1009 (Audit) > 224 (Obscured Security-relevant Information by Alternate Name)
The software records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
*VariantVariantInformation Exposure Through Log Files - (532)
1008 (Architectural Concepts) > 1009 (Audit) > 532 (Information Exposure Through Log Files)
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
*BaseBaseInsufficient Logging - (778)
1008 (Architectural Concepts) > 1009 (Audit) > 778 (Insufficient Logging)
When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it.
*BaseBaseLogging of Excessive Data - (779)
1008 (Architectural Concepts) > 1009 (Audit) > 779 (Logging of Excessive Data)
The software logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.
+CategoryCategoryAuthenticate Actors - (1010)
1008 (Architectural Concepts) > 1010 (Authenticate Actors)
Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
*VariantVariantEmpty Password in Configuration File - (258)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 258 (Empty Password in Configuration File)
Using an empty string as a password is insecure.
*BaseBaseUse of Hard-coded Password - (259)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 259 (Use of Hard-coded Password)
The software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
*VariantVariantNot Using Password Aging - (262)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 262 (Not Using Password Aging)
If no mechanism is in place for managing password aging, users will have no incentive to update passwords in a timely manner.
*BaseBasePassword Aging with Long Expiration - (263)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 263 (Password Aging with Long Expiration)
Allowing password aging to occur unchecked can result in the possibility of diminished password integrity.
*ClassClassImproper Authentication - (287)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 287 (Improper Authentication)
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.authentificationAuthC
*BaseBaseAuthentication Bypass Using an Alternate Path or Channel - (288)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 288 (Authentication Bypass Using an Alternate Path or Channel)
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
*VariantVariantAuthentication Bypass by Alternate Name - (289)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 289 (Authentication Bypass by Alternate Name)
The software performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
*BaseBaseAuthentication Bypass by Spoofing - (290)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 290 (Authentication Bypass by Spoofing)
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
*VariantVariantReliance on IP Address for Authentication - (291)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 291 (Reliance on IP Address for Authentication)
The software uses an IP address for authentication.
*VariantVariantUsing Referer Field for Authentication - (293)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 293 (Using Referer Field for Authentication)
The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.referrer
*BaseBaseAuthentication Bypass by Capture-replay - (294)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 294 (Authentication Bypass by Capture-replay)
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
*VariantVariantReflection Attack in an Authentication Protocol - (301)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 301 (Reflection Attack in an Authentication Protocol)
Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.
*VariantVariantAuthentication Bypass by Assumed-Immutable Data - (302)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 302 (Authentication Bypass by Assumed-Immutable Data)
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
*BaseBaseIncorrect Implementation of Authentication Algorithm - (303)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 303 (Incorrect Implementation of Authentication Algorithm)
The requirements for the software dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
*BaseBaseMissing Critical Step in Authentication - (304)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 304 (Missing Critical Step in Authentication)
The software implements an authentication technique, but it skips a step that weakens the technique.
*BaseBaseAuthentication Bypass by Primary Weakness - (305)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 305 (Authentication Bypass by Primary Weakness)
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
*VariantVariantMissing Authentication for Critical Function - (306)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 306 (Missing Authentication for Critical Function)
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
*BaseBaseImproper Restriction of Excessive Authentication Attempts - (307)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 307 (Improper Restriction of Excessive Authentication Attempts)
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
*BaseBaseUse of Single-factor Authentication - (308)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 308 (Use of Single-factor Authentication)
The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
*BaseBaseKey Exchange without Entity Authentication - (322)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 322 (Key Exchange without Entity Authentication)
The software performs a key exchange with an actor without verifying the identity of that actor.
*BaseBaseWeak Password Requirements - (521)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 521 (Weak Password Requirements)
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
*VariantVariantAuthentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created - (593)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 593 (Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created)
The software modifies the SSL context after connection creation has begun.
*BaseBaseUse of Client-Side Authentication - (603)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 603 (Use of Client-Side Authentication)
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
*VariantVariantUnverified Password Change - (620)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 620 (Unverified Password Change)
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
*BaseBaseWeak Password Recovery Mechanism for Forgotten Password - (640)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 640 (Weak Password Recovery Mechanism for Forgotten Password)
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
*BaseBaseUse of Hard-coded Credentials - (798)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 798 (Use of Hard-coded Credentials)
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
*BaseBaseUse of Password Hash Instead of Password for Authentication - (836)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 836 (Use of Password Hash Instead of Password for Authentication)
The software records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
*BaseBaseUse of Password Hash With Insufficient Computational Effort - (916)
1008 (Architectural Concepts) > 1010 (Authenticate Actors) > 916 (Use of Password Hash With Insufficient Computational Effort)
The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
+CategoryCategoryAuthorize Actors - (1011)
1008 (Architectural Concepts) > 1011 (Authorize Actors)
Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degredation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
*BaseBaseProcess Control - (114)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 114 (Process Control)
Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
*BaseBaseExternal Control of System or Configuration Setting - (15)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 15 (External Control of System or Configuration Setting)
One or more system settings or configuration elements can be externally controlled by a user.
*VariantVariantSensitive Data Under Web Root - (219)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 219 (Sensitive Data Under Web Root)
The application stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
*VariantVariantSensitive Data Under FTP Root - (220)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 220 (Sensitive Data Under FTP Root)
The application stores sensitive data under the FTP document root with insufficient access control, which might make it accessible to untrusted parties.
*BaseBaseIncorrect Privilege Assignment - (266)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 266 (Incorrect Privilege Assignment)
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
*BaseBasePrivilege Defined With Unsafe Actions - (267)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 267 (Privilege Defined With Unsafe Actions)
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
*BaseBasePrivilege Chaining - (268)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 268 (Privilege Chaining)
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
*ClassClassImproper Privilege Management - (269)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 269 (Improper Privilege Management)
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
*BaseBasePrivilege Context Switching Error - (270)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 270 (Privilege Context Switching Error)
The software does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
*ClassClassPrivilege Dropping / Lowering Errors - (271)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 271 (Privilege Dropping / Lowering Errors)
The software does not drop privileges before passing control of a resource to an actor that does not have those privileges.
*BaseBaseLeast Privilege Violation - (272)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 272 (Least Privilege Violation)
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
*BaseBaseImproper Check for Dropped Privileges - (273)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 273 (Improper Check for Dropped Privileges)
The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
*BaseBaseImproper Handling of Insufficient Privileges - (274)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 274 (Improper Handling of Insufficient Privileges)
The software does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
*VariantVariantIncorrect Default Permissions - (276)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 276 (Incorrect Default Permissions)
The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.
*VariantVariantInsecure Inherited Permissions - (277)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 277 (Insecure Inherited Permissions)
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
*VariantVariantIncorrect Execution-Assigned Permissions - (279)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 279 (Incorrect Execution-Assigned Permissions)
While it is executing, the software sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
*BaseBaseImproper Handling of Insufficient Permissions or Privileges - (280)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 280 (Improper Handling of Insufficient Permissions or Privileges )
The application does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the application in an invalid state.
*BaseBaseImproper Preservation of Permissions - (281)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 281 (Improper Preservation of Permissions)
The software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
*ClassClassImproper Ownership Management - (282)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 282 (Improper Ownership Management)
The software assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
*BaseBaseUnverified Ownership - (283)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 283 (Unverified Ownership)
The software does not properly verify that a critical resource is owned by the proper entity.
*ClassClassImproper Access Control - (284)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 284 (Improper Access Control)
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Authorization
*ClassClassImproper Authorization - (285)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 285 (Improper Authorization)
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.AuthZ
*ClassClassIncorrect User Management - (286)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 286 (Incorrect User Management)
The software does not properly manage a user within its environment.
*ClassClassChannel Accessible by Non-Endpoint ('Man-in-the-Middle') - (300)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 300 (Channel Accessible by Non-Endpoint ('Man-in-the-Middle'))
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
*BaseBasePredictable from Observable State - (341)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 341 (Predictable from Observable State)
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
*ClassClassExposure of Private Information ('Privacy Violation') - (359)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 359 (Exposure of Private Information ('Privacy Violation'))
The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related.Privacy leakPrivacy leakage
*BaseBaseExposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') - (403)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak'))
A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.File descriptor leak
*BaseBaseUnprotected Primary Channel - (419)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 419 (Unprotected Primary Channel)
The software uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
*BaseBaseUnprotected Alternate Channel - (420)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 420 (Unprotected Alternate Channel)
The software protects a primary channel, but it does not use the same level of protection for an alternate channel.
*BaseBaseDirect Request ('Forced Browsing') - (425)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 425 (Direct Request ('Forced Browsing'))
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.forced browsing
*CompositeCompositeUntrusted Search Path - (426)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 426 (Untrusted Search Path)
The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.Untrusted Path
*BaseBaseUnrestricted Upload of File with Dangerous Type - (434)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 434 (Unrestricted Upload of File with Dangerous Type)
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.Unrestricted File Upload
*VariantVariantExposure of CVS Repository to an Unauthorized Control Sphere - (527)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 527 (Exposure of CVS Repository to an Unauthorized Control Sphere)
The product stores a CVS repository in a directory or other container that is accessible to actors outside of the intended control sphere.
*VariantVariantExposure of Core Dump File to an Unauthorized Control Sphere - (528)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 528 (Exposure of Core Dump File to an Unauthorized Control Sphere)
The product generates a core dump file in a directory that is accessible to actors outside of the intended control sphere.
*VariantVariantExposure of Access Control List Files to an Unauthorized Control Sphere - (529)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 529 (Exposure of Access Control List Files to an Unauthorized Control Sphere)
The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
*VariantVariantExposure of Backup File to an Unauthorized Control Sphere - (530)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 530 (Exposure of Backup File to an Unauthorized Control Sphere)
A backup file is stored in a directory that is accessible to actors outside of the intended control sphere.
*BaseBaseFile and Directory Information Exposure - (538)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 538 (File and Directory Information Exposure)
The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere.
*BaseBaseIncorrect Behavior Order: Authorization Before Parsing and Canonicalization - (551)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization)
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
*BaseBaseFiles or Directories Accessible to External Parties - (552)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 552 (Files or Directories Accessible to External Parties)
Files or directories are accessible in the environment that should not be.
*VariantVariantAuthorization Bypass Through User-Controlled SQL Primary Key - (566)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 566 (Authorization Bypass Through User-Controlled SQL Primary Key)
The software uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
*BaseBaseAuthorization Bypass Through User-Controlled Key - (639)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 639 (Authorization Bypass Through User-Controlled Key)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.Insecure Direct Object ReferenceHorizontal Authorization
*ClassClassExternal Control of Critical State Data - (642)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 642 (External Control of Critical State Data)
The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.
*VariantVariantUse of Non-Canonical URL Paths for Authorization Decisions - (647)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 647 (Use of Non-Canonical URL Paths for Authorization Decisions)
The software defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
*BaseBaseInsufficient Compartmentalization - (653)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 653 (Insufficient Compartmentalization)
The product does not sufficiently compartmentalize functionality or processes that require different privilege levels, rights, or permissions.Separation of Privilege
*BaseBaseReliance on Security Through Obscurity - (656)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 656 (Reliance on Security Through Obscurity)
The software uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.Never Assuming your secrets are safe
*ClassClassExposure of Resource to Wrong Sphere - (668)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 668 (Exposure of Resource to Wrong Sphere)
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
*ClassClassIncorrect Resource Transfer Between Spheres - (669)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 669 (Incorrect Resource Transfer Between Spheres)
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
*ClassClassLack of Administrator Control over Security - (671)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 671 (Lack of Administrator Control over Security)
The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
*ClassClassExternal Influence of Sphere Definition - (673)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 673 (External Influence of Sphere Definition)
The product does not prevent the definition of control spheres from external actors.
*BaseBaseIncorrect Ownership Assignment - (708)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 708 (Incorrect Ownership Assignment)
The software assigns an owner to a resource, but the owner is outside of the intended control sphere.
*ClassClassIncorrect Permission Assignment for Critical Resource - (732)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 732 (Incorrect Permission Assignment for Critical Resource)
The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
*BaseBaseAllocation of Resources Without Limits or Throttling - (770)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 770 (Allocation of Resources Without Limits or Throttling)
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy for that actor.
*VariantVariantExposed IOCTL with Insufficient Access Control - (782)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 782 (Exposed IOCTL with Insufficient Access Control)
The software implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
*BaseBaseImproper Control of Document Type Definition - (827)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 827 (Improper Control of Document Type Definition)
The software does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the software to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
*ClassClassMissing Authorization - (862)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 862 (Missing Authorization)
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.AuthZ
*ClassClassIncorrect Authorization - (863)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 863 (Incorrect Authorization)
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.AuthZ
*BaseBaseStorage of Sensitive Data in a Mechanism without Access Control - (921)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 921 (Storage of Sensitive Data in a Mechanism without Access Control)
The software stores sensitive information in a file system or device that does not have built-in access control.
*ClassClassImproper Restriction of Communication Channel to Intended Endpoints - (923)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 923 (Improper Restriction of Communication Channel to Intended Endpoints)
The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
*BaseBaseImproper Authorization in Handler for Custom URL Scheme - (939)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 939 (Improper Authorization in Handler for Custom URL Scheme)
The software uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
*VariantVariantOverly Permissive Cross-domain Whitelist - (942)
1008 (Architectural Concepts) > 1011 (Authorize Actors) > 942 (Overly Permissive Cross-domain Whitelist)
The software uses a cross-domain policy file that includes domains that should not be trusted.
+CategoryCategoryCross Cutting - (1012)
1008 (Architectural Concepts) > 1012 (Cross Cutting)
Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.
*BaseBaseInformation Exposure Through Timing Discrepancy - (208)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 208 (Information Exposure Through Timing Discrepancy)
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
*BaseBaseMissing Report of Error Condition - (392)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 392 (Missing Report of Error Condition)
The software encounters an error but does not provide a status code or return value to indicate that an error has occurred.
*VariantVariantImproper Cleanup on Thrown Exception - (460)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 460 (Improper Cleanup on Thrown Exception)
The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
*BaseBaseMissing Standardized Error Handling Mechanism - (544)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 544 (Missing Standardized Error Handling Mechanism)
The software does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
*BaseBaseClient-Side Enforcement of Server-Side Security - (602)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 602 (Client-Side Enforcement of Server-Side Security)
The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
*ClassClassImproper Check or Handling of Exceptional Conditions - (703)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 703 (Improper Check or Handling of Exceptional Conditions)
The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.
*ClassClassImproper Check for Unusual or Exceptional Conditions - (754)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 754 (Improper Check for Unusual or Exceptional Conditions)
The software does not check or improperly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.
*VariantVariantReliance on Cookies without Validation and Integrity Checking in a Security Decision - (784)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 784 (Reliance on Cookies without Validation and Integrity Checking in a Security Decision)
The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
*BaseBaseReliance on Untrusted Inputs in a Security Decision - (807)
1008 (Architectural Concepts) > 1012 (Cross Cutting) > 807 (Reliance on Untrusted Inputs in a Security Decision)
The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
+CategoryCategoryEncrypt Data - (1013)
1008 (Architectural Concepts) > 1013 (Encrypt Data)
Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encyprtion if they are not addressed when designing or implementing a secure architecture.
*VariantVariantPlaintext Storage of a Password - (256)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 256 (Plaintext Storage of a Password)
Storing a password in plaintext may result in a system compromise.
*BaseBaseStoring Passwords in a Recoverable Format - (257)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 257 (Storing Passwords in a Recoverable Format)
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
*VariantVariantPassword in Configuration File - (260)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 260 (Password in Configuration File)
The software stores a password in a configuration file that might be accessible to actors who do not know the password.
*VariantVariantWeak Cryptography for Passwords - (261)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 261 (Weak Cryptography for Passwords)
Obscuring a password with a trivial encoding does not protect the password.
*BaseBaseMissing Encryption of Sensitive Data - (311)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 311 (Missing Encryption of Sensitive Data)
The software does not encrypt sensitive or critical information before storage or transmission.
*BaseBaseCleartext Storage of Sensitive Information - (312)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 312 (Cleartext Storage of Sensitive Information)
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
*VariantVariantCleartext Storage in a File or on Disk - (313)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 313 (Cleartext Storage in a File or on Disk)
The application stores sensitive information in cleartext in a file, or on disk.
*VariantVariantCleartext Storage in the Registry - (314)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 314 (Cleartext Storage in the Registry)
The application stores sensitive information in cleartext in the registry.
*VariantVariantCleartext Storage of Sensitive Information in a Cookie - (315)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 315 (Cleartext Storage of Sensitive Information in a Cookie)
The application stores sensitive information in cleartext in a cookie.
*VariantVariantCleartext Storage of Sensitive Information in Memory - (316)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 316 (Cleartext Storage of Sensitive Information in Memory)
The application stores sensitive information in cleartext in memory.
*VariantVariantCleartext Storage of Sensitive Information in GUI - (317)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 317 (Cleartext Storage of Sensitive Information in GUI)
The application stores sensitive information in cleartext within the GUI.
*VariantVariantCleartext Storage of Sensitive Information in Executable - (318)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 318 (Cleartext Storage of Sensitive Information in Executable)
The application stores sensitive information in cleartext in an executable.
*BaseBaseCleartext Transmission of Sensitive Information - (319)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 319 (Cleartext Transmission of Sensitive Information)
The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
*BaseBaseUse of Hard-coded Cryptographic Key - (321)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 321 (Use of Hard-coded Cryptographic Key)
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
*BaseBaseReusing a Nonce, Key Pair in Encryption - (323)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 323 (Reusing a Nonce, Key Pair in Encryption)
Nonces should be used for the present occasion and only once.
*BaseBaseUse of a Key Past its Expiration Date - (324)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 324 (Use of a Key Past its Expiration Date)
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
*BaseBaseMissing Required Cryptographic Step - (325)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 325 (Missing Required Cryptographic Step)
The software does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by that algorithm.
*ClassClassInadequate Encryption Strength - (326)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 326 (Inadequate Encryption Strength)
The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
*BaseBaseUse of a Broken or Risky Cryptographic Algorithm - (327)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 327 (Use of a Broken or Risky Cryptographic Algorithm)
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
*BaseBaseReversible One-Way Hash - (328)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 328 (Reversible One-Way Hash)
The product uses a hashing algorithm that produces a hash value that can be used to determine the original input, or to find an input that can produce the same hash, more efficiently than brute force techniques.
*ClassClassUse of Insufficiently Random Values - (330)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 330 (Use of Insufficiently Random Values)
The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.
*BaseBaseInsufficient Entropy - (331)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 331 (Insufficient Entropy)
The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
*VariantVariantInsufficient Entropy in PRNG - (332)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 332 (Insufficient Entropy in PRNG)
The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
*VariantVariantImproper Handling of Insufficient Entropy in TRNG - (333)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 333 (Improper Handling of Insufficient Entropy in TRNG)
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
*BaseBaseSmall Space of Random Values - (334)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 334 (Small Space of Random Values)
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
*BaseBaseIncorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) - (335)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 335 (Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG))
The software uses a Pseudo-Random Number Generator (PRNG) that does not correctly manage seeds.
*BaseBaseSame Seed in Pseudo-Random Number Generator (PRNG) - (336)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 336 (Same Seed in Pseudo-Random Number Generator (PRNG))
A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
*BaseBasePredictable Seed in Pseudo-Random Number Generator (PRNG) - (337)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 337 (Predictable Seed in Pseudo-Random Number Generator (PRNG))
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
*BaseBaseUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - (338)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 338 (Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG))
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
*BaseBaseSmall Seed Space in PRNG - (339)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 339 (Small Seed Space in PRNG)
A PRNG uses a relatively small space of seeds.
*BaseBaseImproper Verification of Cryptographic Signature - (347)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 347 (Improper Verification of Cryptographic Signature)
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
*BaseBaseInsufficiently Protected Credentials - (522)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 522 (Insufficiently Protected Credentials)
This weakness occurs when the application transmits or stores authentication credentials and uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
*VariantVariantUnprotected Transport of Credentials - (523)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 523 (Unprotected Transport of Credentials)
Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.
*ClassClassSelection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') - (757)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 757 (Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'))
A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
*BaseBaseUse of a One-Way Hash without a Salt - (759)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 759 (Use of a One-Way Hash without a Salt)
The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input.
*BaseBaseUse of a One-Way Hash with a Predictable Salt - (760)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 760 (Use of a One-Way Hash with a Predictable Salt)
The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software uses a predictable salt as part of the input.
*VariantVariantUse of RSA Algorithm without OAEP - (780)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 780 (Use of RSA Algorithm without OAEP)
The software uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
*ClassClassInsecure Storage of Sensitive Information - (922)
1008 (Architectural Concepts) > 1013 (Encrypt Data) > 922 (Insecure Storage of Sensitive Information)
The software stores sensitive information without properly limiting read or write access by unauthorized actors.
+CategoryCategoryIdentify Actors - (1014)
1008 (Architectural Concepts) > 1014 (Identify Actors)
Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification maangment if they are not addressed when designing or implementing a secure architecture.
*BaseBaseImproper Certificate Validation - (295)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 295 (Improper Certificate Validation)
The software does not validate, or incorrectly validates, a certificate.
*BaseBaseImproper Following of a Certificate's Chain of Trust - (296)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 296 (Improper Following of a Certificate's Chain of Trust)
The software does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
*VariantVariantImproper Validation of Certificate with Host Mismatch - (297)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 297 (Improper Validation of Certificate with Host Mismatch)
The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host.
*VariantVariantImproper Validation of Certificate Expiration - (298)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 298 (Improper Validation of Certificate Expiration)
A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to certificates that have been abandoned due to age.
*BaseBaseImproper Check for Certificate Revocation - (299)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 299 (Improper Check for Certificate Revocation)
The software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
*ClassClassInsufficient Verification of Data Authenticity - (345)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 345 (Insufficient Verification of Data Authenticity)
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
*BaseBaseOrigin Validation Error - (346)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 346 (Origin Validation Error)
The software does not properly verify that the source of data or communication is valid.
*VariantVariantMissing Check for Certificate Revocation after Initial Check - (370)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 370 (Missing Check for Certificate Revocation after Initial Check)
The software does not check the revocation status of a certificate after its initial revocation check, which can cause the software to perform privileged actions even after the certificate is revoked at a later time.
*ClassClassUnintended Proxy or Intermediary ('Confused Deputy') - (441)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 441 (Unintended Proxy or Intermediary ('Confused Deputy'))
The software receives a request, message, or directive from an upstream component, but the software does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the software's control sphere. This causes the software to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.Confused Deputy
*VariantVariantMissing Validation of OpenSSL Certificate - (599)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 599 (Missing Validation of OpenSSL Certificate)
The software uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
*BaseBaseImproper Verification of Source of a Communication Channel - (940)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 940 (Improper Verification of Source of a Communication Channel)
The software establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
*BaseBaseIncorrectly Specified Destination in a Communication Channel - (941)
1008 (Architectural Concepts) > 1014 (Identify Actors) > 941 (Incorrectly Specified Destination in a Communication Channel)
The software creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
+CategoryCategoryLimit Access - (1015)
1008 (Architectural Concepts) > 1015 (Limit Access)
Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
*VariantVariantInformation Exposure Through Sent Data - (201)
1008 (Architectural Concepts) > 1015 (Limit Access) > 201 (Information Exposure Through Sent Data)
The accidental exposure of sensitive information through sent data refers to the transmission of data which are either sensitive in and of itself or useful in the further exploitation of the system through standard data channels.
*BaseBaseInformation Exposure Through an Error Message - (209)
1008 (Architectural Concepts) > 1015 (Limit Access) > 209 (Information Exposure Through an Error Message)
The software generates an error message that includes sensitive information about its environment, users, or associated data.
*BaseBaseImproper Cross-boundary Removal of Sensitive Data - (212)
1008 (Architectural Concepts) > 1015 (Limit Access) > 212 (Improper Cross-boundary Removal of Sensitive Data)
The software uses a resource that contains sensitive data, but it does not properly remove that data before it stores, transfers, or shares the resource with actors in another control sphere.
*VariantVariantCreation of chroot Jail Without Changing Working Directory - (243)
1008 (Architectural Concepts) > 1015 (Limit Access) > 243 (Creation of chroot Jail Without Changing Working Directory)
The program uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
*ClassClassExecution with Unnecessary Privileges - (250)
1008 (Architectural Concepts) > 1015 (Limit Access) > 250 (Execution with Unnecessary Privileges)
The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
*ClassClassExternally Controlled Reference to a Resource in Another Sphere - (610)
1008 (Architectural Concepts) > 1015 (Limit Access) > 610 (Externally Controlled Reference to a Resource in Another Sphere)
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
*VariantVariantImproper Restriction of XML External Entity Reference ('XXE') - (611)
1008 (Architectural Concepts) > 1015 (Limit Access) > 611 (Improper Restriction of XML External Entity Reference ('XXE'))
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.XXE
*ClassClassExternal Control of File Name or Path - (73)
1008 (Architectural Concepts) > 1015 (Limit Access) > 73 (External Control of File Name or Path)
The software allows user input to control or influence paths or file names that are used in filesystem operations.
+CategoryCategoryLimit Exposure - (1016)
1008 (Architectural Concepts) > 1016 (Limit Exposure)
Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.
*BaseBaseInformation Exposure Through Self-generated Error Message - (210)
1008 (Architectural Concepts) > 1016 (Limit Exposure) > 210 (Information Exposure Through Self-generated Error Message)
The software identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
*BaseBaseInformation Exposure Through Externally-Generated Error Message - (211)
1008 (Architectural Concepts) > 1016 (Limit Exposure) > 211 (Information Exposure Through Externally-Generated Error Message)
The software performs an operation that triggers an external diagnostic or error message that is not directly generated by the software, such as an error generated by the programming language interpreter that the software uses. The error can contain sensitive system information.
*VariantVariantInformation Exposure Through Process Environment - (214)
1008 (Architectural Concepts) > 1016 (Limit Exposure) > 214 (Information Exposure Through Process Environment)
A process is invoked with sensitive arguments, environment variables, or other elements that can be seen by other processes on the operating system.
*VariantVariantInformation Exposure Through Server Error Message - (550)
1008 (Architectural Concepts) > 1016 (Limit Exposure) > 550 (Information Exposure Through Server Error Message)
Certain conditions, such as network failure, will cause a server error message to be displayed.
*ClassClassInclusion of Functionality from Untrusted Control Sphere - (829)
1008 (Architectural Concepts) > 1016 (Limit Exposure) > 829 (Inclusion of Functionality from Untrusted Control Sphere)
The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
*BaseBaseInclusion of Web Functionality from an Untrusted Source - (830)
1008 (Architectural Concepts) > 1016 (Limit Exposure) > 830 (Inclusion of Web Functionality from an Untrusted Source)
The software includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the software, potentially granting total access and control of the software to the untrusted source.
+CategoryCategoryLock Computer - (1017)
1008 (Architectural Concepts) > 1017 (Lock Computer)
Weaknesses in this category are related to the design and architecture of a system's lockout mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts to access a given resource. The weaknesses in this category could lead to a degradation of access to system assets if they are not addressed when designing or implementing a secure architecture.
*BaseBaseOverly Restrictive Account Lockout Mechanism - (645)
1008 (Architectural Concepts) > 1017 (Lock Computer) > 645 (Overly Restrictive Account Lockout Mechanism)
The software contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
+CategoryCategoryManage User Sessions - (1018)
1008 (Architectural Concepts) > 1018 (Manage User Sessions)
Weaknesses in this category are related to the design and architecture of session managment. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session managment if they are not addressed when designing or implementing a secure architecture.
*CompositeCompositeSession Fixation - (384)
1008 (Architectural Concepts) > 1018 (Manage User Sessions) > 384 (Session Fixation)
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
*VariantVariantExposure of Data Element to Wrong Session - (488)
1008 (Architectural Concepts) > 1018 (Manage User Sessions) > 488 (Exposure of Data Element to Wrong Session)
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
*VariantVariantJ2EE Bad Practices: Non-serializable Object Stored in Session - (579)
1008 (Architectural Concepts) > 1018 (Manage User Sessions) > 579 (J2EE Bad Practices: Non-serializable Object Stored in Session)
The application stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
*VariantVariantJ2EE Misconfiguration: Insufficient Session-ID Length - (6)
1008 (Architectural Concepts) > 1018 (Manage User Sessions) > 6 (J2EE Misconfiguration: Insufficient Session-ID Length)
The J2EE application is configured to use an insufficient session ID length.
*BaseBaseInsufficient Session Expiration - (613)
1008 (Architectural Concepts) > 1018 (Manage User Sessions) > 613 (Insufficient Session Expiration)
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
*BaseBaseImproper Enforcement of Behavioral Workflow - (841)
1008 (Architectural Concepts) > 1018 (Manage User Sessions) > 841 (Improper Enforcement of Behavioral Workflow)
The software supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
+CategoryCategoryValidate Inputs - (1019)
1008 (Architectural Concepts) > 1019 (Validate Inputs)
Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
*ClassClassImproper Neutralization of Special Elements - (138)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 138 (Improper Neutralization of Special Elements)
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
*VariantVariantImproper Neutralization of Escape, Meta, or Control Sequences - (150)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 150 (Improper Neutralization of Escape, Meta, or Control Sequences)
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
*ClassClassImproper Input Validation - (20)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 20 (Improper Input Validation)
The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
*BaseBaseAcceptance of Extraneous Untrusted Data With Trusted Data - (349)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 349 (Acceptance of Extraneous Untrusted Data With Trusted Data)
The software, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
*CompositeCompositeCross-Site Request Forgery (CSRF) - (352)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 352 (Cross-Site Request Forgery (CSRF))
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Session RidingCross Site Reference ForgeryXSRF
*BaseBaseExternal Control of Assumed-Immutable Web Parameter - (472)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 472 (External Control of Assumed-Immutable Web Parameter)
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.Assumed-Immutable Parameter Tampering
*VariantVariantPHP External Variable Modification - (473)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 473 (PHP External Variable Modification)
A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
*VariantVariantDeserialization of Untrusted Data - (502)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 502 (Deserialization of Untrusted Data)
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Marshaling, UnmarshalingPickling, Unpickling
*BaseBaseImproper Link Resolution Before File Access ('Link Following') - (59)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 59 (Improper Link Resolution Before File Access ('Link Following'))
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.insecure temporary file
*VariantVariantURL Redirection to Untrusted Site ('Open Redirect') - (601)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 601 (URL Redirection to Untrusted Site ('Open Redirect'))
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.Open RedirectCross-site RedirectCross-domain Redirect
*BaseBaseImproper Restriction of Names for Files and Other Resources - (641)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 641 (Improper Restriction of Names for Files and Other Resources)
The application constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
*BaseBaseImproper Neutralization of Data within XPath Expressions ('XPath Injection') - (643)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 643 (Improper Neutralization of Data within XPath Expressions ('XPath Injection'))
The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
*BaseBaseImproper Neutralization of Data within XQuery Expressions ('XQuery Injection') - (652)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 652 (Improper Neutralization of Data within XQuery Expressions ('XQuery Injection'))
The software uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
*ClassClassImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - (74)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
*ClassClassFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) - (75)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 75 (Failure to Sanitize Special Elements into a Different Plane (Special Element Injection))
The software does not adequately filter user-controlled input for special elements with control implications.
*BaseBaseImproper Neutralization of Equivalent Special Elements - (76)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 76 (Improper Neutralization of Equivalent Special Elements)
The software properly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
*ClassClassImproper Neutralization of Special Elements used in a Command ('Command Injection') - (77)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
*BaseBaseImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - (78)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Shell injectionShell metacharacters
*BaseBaseImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.XSSCSS
*ClassClassImproper Filtering of Special Elements - (790)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 790 (Improper Filtering of Special Elements)
The software receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
*BaseBaseIncomplete Filtering of Special Elements - (791)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 791 (Incomplete Filtering of Special Elements)
The software receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
*VariantVariantIncomplete Filtering of One or More Instances of Special Elements - (792)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 792 (Incomplete Filtering of One or More Instances of Special Elements)
The software receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.
*VariantVariantOnly Filtering One Instance of a Special Element - (793)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 793 (Only Filtering One Instance of a Special Element)
The software receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.
*VariantVariantIncomplete Filtering of Multiple Instances of Special Elements - (794)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 794 (Incomplete Filtering of Multiple Instances of Special Elements)
The software receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component.
*BaseBaseOnly Filtering Special Elements at a Specified Location - (795)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 795 (Only Filtering Special Elements at a Specified Location)
The software receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.
*VariantVariantOnly Filtering Special Elements Relative to a Marker - (796)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 796 (Only Filtering Special Elements Relative to a Marker)
The software receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component.
*VariantVariantOnly Filtering Special Elements at an Absolute Position - (797)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 797 (Only Filtering Special Elements at an Absolute Position)
The software receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.
*BaseBaseArgument Injection or Modification - (88)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 88 (Argument Injection or Modification)
The software does not sufficiently delimit the arguments being passed to a component in another control sphere, allowing alternate arguments to be provided, leading to potentially security-relevant changes.
*BaseBaseImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
*BaseBaseImproper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') - (90)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
*BaseBaseXML Injection (aka Blind XPath Injection) - (91)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 91 (XML Injection (aka Blind XPath Injection))
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
*BaseBaseImproper Neutralization of CRLF Sequences ('CRLF Injection') - (93)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
*ClassClassImproper Control of Generation of Code ('Code Injection') - (94)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 94 (Improper Control of Generation of Code ('Code Injection'))
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
*ClassClassImproper Neutralization of Special Elements in Data Query Logic - (943)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 943 (Improper Neutralization of Special Elements in Data Query Logic)
The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
*BaseBaseImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - (95)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
*BaseBaseImproper Neutralization of Directives in Statically Saved Code ('Static Code Injection') - (96)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 96 (Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection'))
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
*VariantVariantImproper Neutralization of Server-Side Includes (SSI) Within a Web Page - (97)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 97 (Improper Neutralization of Server-Side Includes (SSI) Within a Web Page)
The software generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
*BaseBaseImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') - (98)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'))
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.Remote file includeRFILocal file inclusion
*BaseBaseImproper Control of Resource Identifiers ('Resource Injection') - (99)
1008 (Architectural Concepts) > 1019 (Validate Inputs) > 99 (Improper Control of Resource Identifiers ('Resource Injection'))
The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.Insecure Direct Object Reference
+CategoryCategoryVerify Message Integrity - (1020)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity)
Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.
*BaseBaseMissing Support for Integrity Check - (353)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 353 (Missing Support for Integrity Check)
The software uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
*BaseBaseImproper Validation of Integrity Check Value - (354)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 354 (Improper Validation of Integrity Check Value)
The software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
*ClassClassDetection of Error Condition Without Action - (390)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 390 (Detection of Error Condition Without Action)
The software detects a specific error, but takes no actions to handle the error.
*BaseBaseUnchecked Error Condition - (391)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 391 (Unchecked Error Condition)
Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
*BaseBaseDownload of Code Without Integrity Check - (494)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 494 (Download of Code Without Integrity Check)
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
*BaseBaseReliance on Cookies without Validation and Integrity Checking - (565)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 565 (Reliance on Cookies without Validation and Integrity Checking)
The application relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
*BaseBaseReliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking - (649)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 649 (Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking)
The software uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the software does not use integrity checks to detect if those inputs have been modified.
*ClassClassImproper Enforcement of Message or Data Structure - (707)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 707 (Improper Enforcement of Message or Data Structure)
The software does not enforce or incorrectly enforces that structured messages or data are well-formed before being read from an upstream component or sent to a downstream component.
*ClassClassImproper Handling of Exceptional Conditions - (755)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 755 (Improper Handling of Exceptional Conditions)
The software does not handle or incorrectly handles an exceptional condition.
*ClassClassImproper Enforcement of Message Integrity During Transmission in a Communication Channel - (924)
1008 (Architectural Concepts) > 1020 (Verify Message Integrity) > 924 (Improper Enforcement of Message Integrity During Transmission in a Communication Channel)
The software establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
+ Notes

Maintenance

This view is under development, and subsequent releases will focus on reviewing the individual weaknesses to verify their inclusion in this view and adding any applicable ChildOf relationships. Comments about revisions are welcome.
+ References
[REF-9] Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <https://design.se.rit.edu/papers/cawe-paper.pdf>.
[REF-10] Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.". pages 69 - 78. 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf>.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2017-06-22Joanna C.S. Santos, Mehdi Mirakhorli
Provided the catalog, Common Architectural Weakness Enumeration (CAWE), and research papers for this view.
+ View Metrics
CWEs in this viewTotal CWEs
Total235out of982
Weaknesses223out of 714
Categories12out of 237
Views0out of 31

CWE-88: Argument Injection or Modification

Weakness ID: 88
Abstraction: Base
Structure: Simple
Status: Draft
Presentation Filter:
+ Description
The software does not sufficiently delimit the arguments being passed to a component in another control sphere, allowing alternate arguments to be provided, leading to potentially security-relevant changes.
+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
+ Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (CWE-1003)
+ Relevant to the view "Architectural Concepts" (CWE-1008)
NatureTypeIDName
MemberOfCategoryCategory1019Validate Inputs
+ Relevant to the view "Development Concepts" (CWE-699)
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
ImplementationREALIZATION: This weakness is caused during implementation of an architectural security tactic.
+ Applicable Platforms