The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Modes of Introduction:
– Implementation
Likelihood of Exploit:
Other: Varies by Context
The web application sends a redirect to another location, but instead of exiting, it executes additional code.
Modes of Introduction:
– Implementation
Likelihood of Exploit:
Other, Confidentiality, Integrity, Availability: Alter Execution Logic, Execute Unauthorized Code or Commands
This weakness could affect the control flow of the application and allow execution of untrusted code.
The default error page of a web application should not display sensitive information about the software system.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Confidentiality: Read Application Data
A stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.
Phase: Implementation
Effectiveness:
Description:
Handle exceptions appropriately in source code.
Phase: Implementation, System Configuration
Effectiveness:
Description:
Always define appropriate error pages. The application configuration should specify a default error page in order to guarantee that the application will never leak error messages to an attacker. Handling standard HTTP error codes is useful and user-friendly in addition to being a good security practice, and a good configuration will also define a last-chance error handler that catches any exception that could possibly be thrown by the application.
Phase: Implementation
Effectiveness:
Description:
Do not attempt to process an error or attempt to mask it.
Phase: Implementation
Effectiveness:
Description:
Verify return values are correct and do not supply sensitive information about the system.
The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Confidentiality, Availability, Integrity: Read Application Data, DoS: Crash, Exit, or Restart, Unexpected State
The software does not correctly convert an object, resource, or structure from one type to a different type.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Other: Other
The software does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Other: Alter Execution Logic, Other
The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Confidentiality, Integrity: Read Application Data, Modify Application Data
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Other: Other
The software assigns an owner to a resource, but the owner is outside of the intended control sphere.
This may allow the resource to be manipulated by actors outside of the intended control sphere.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Confidentiality, Integrity: Read Application Data, Modify Application Data
An attacker could read and modify data for which they do not have permissions to access directly.
Phase: Policy
Effectiveness:
Description:
Periodically review the privileges and their owners.
Phase: Testing
Effectiveness:
Description:
Use automated tools to check for privilege settings.
This entry has been deprecated as it represents a specific observed example of a UNIX Hard Link weakness type rather than its own individual weakness type. Please refer to CWE-62.
Modes of Introduction:
Likelihood of Exploit: