Common Weakness Enumeration

CWE-1083

Weakness Prohibited

Data Access from Outside Expected Data Manager Component

Abstraction: Base · Status: Incomplete

The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.

Mapping guidance

This entry is primarily a quality issue with no direct security implications.

Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

Relationships and members

ChildOf: CWE-1061 · View CWE-1000

Modes of introduction

Implementation

Detection methods

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Content history

Submission: CWE Content Team · MITRE · 2018-07-02 · CWE 3.2

Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Relationships

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2024-02-29 · CWE 4.14

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Common_Consequences, Description, Detection_Factors, References

2 vulnerabilities reference this CWE, most recent first.

CVE-2022-2493 (GCVE-0-2022-2493)

Vulnerability from cvelistv5 – Published: 2022-07-22 03:47 – Updated: 2024-08-03 00:39

Title

Data Access from Outside Expected Data Manager Component in openemr/openemr

Summary

Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.

Severity

8.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CWE

CWE-1083 - Data Access from Outside Expected Data Manager Component

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://huntr.dev/bounties/8a4d54e2-e1cd-47c3-930…	x_refsource_CONFIRM
https://github.com/openemr/openemr/commit/871ae51…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
openemr	openemr/openemr	Affected: unspecified , < 7.0.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:39:07.731Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/8a4d54e2-e1cd-47c3-9304-ac8be87c80f1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/openemr/openemr/commit/871ae5198d8ca18fd17257ae7c5c906a52dca908"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openemr/openemr",
          "vendor": "openemr",
          "versions": [
            {
              "lessThan": "7.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1083",
              "description": "CWE-1083 Data Access from Outside Expected Data Manager Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-22T03:47:17.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/8a4d54e2-e1cd-47c3-9304-ac8be87c80f1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openemr/openemr/commit/871ae5198d8ca18fd17257ae7c5c906a52dca908"
        }
      ],
      "source": {
        "advisory": "8a4d54e2-e1cd-47c3-9304-ac8be87c80f1",
        "discovery": "EXTERNAL"
      },
      "title": "Data Access from Outside Expected Data Manager Component in openemr/openemr",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-2493",
          "STATE": "PUBLIC",
          "TITLE": "Data Access from Outside Expected Data Manager Component in openemr/openemr"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "openemr/openemr",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "7.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "openemr"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1083 Data Access from Outside Expected Data Manager Component"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/8a4d54e2-e1cd-47c3-9304-ac8be87c80f1",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/8a4d54e2-e1cd-47c3-9304-ac8be87c80f1"
            },
            {
              "name": "https://github.com/openemr/openemr/commit/871ae5198d8ca18fd17257ae7c5c906a52dca908",
              "refsource": "MISC",
              "url": "https://github.com/openemr/openemr/commit/871ae5198d8ca18fd17257ae7c5c906a52dca908"
            }
          ]
        },
        "source": {
          "advisory": "8a4d54e2-e1cd-47c3-9304-ac8be87c80f1",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-2493",
    "datePublished": "2022-07-22T03:47:17.000Z",
    "dateReserved": "2022-07-20T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:39:07.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-4F96-MFG4-QX5F

Vulnerability from github – Published: 2022-07-23 00:00 – Updated: 2022-07-28 00:00

Details

Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-2493"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1083"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-22T04:15:00Z",
    "severity": "HIGH"
  },
  "details": "Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.",
  "id": "GHSA-4f96-mfg4-qx5f",
  "modified": "2022-07-28T00:00:41Z",
  "published": "2022-07-23T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2493"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openemr/openemr/commit/871ae5198d8ca18fd17257ae7c5c906a52dca908"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/8a4d54e2-e1cd-47c3-9304-ac8be87c80f1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list