Common Weakness Enumeration

CWE-1106

Weakness Prohibited

Insufficient Use of Symbolic Constants

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.

Mapping guidance

This entry is primarily a quality issue with no direct security implications.

Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

Relationships and members
ChildOf: CWE-1078 · View CWE-1000
Modes of introduction
Implementation
Detection methods

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Content history
Submission: CWE Content Team · MITRE · 2018-07-02 · CWE 3.2

Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2024-02-29 · CWE 4.14

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Time_of_Introduction

1 vulnerability references this CWE, most recent first.

GHSA-7333-WPQM-63V7

Vulnerability from github – Published: 2024-06-11 00:30 – Updated: 2024-06-11 00:30
VLAI
Details

A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-36358"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1106"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-10T22:15:11Z",
    "severity": "HIGH"
  },
  "details": "A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
  "id": "GHSA-7333-wpqm-63v7",
  "modified": "2024-06-11T00:30:40Z",
  "published": "2024-06-11T00:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36358"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/dcx/s/solution/000298151"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-575"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list