1780
Applicable Platform
This weakness is possible in any type-unsafe programming language.
Research Gap
Type confusion weaknesses have received some attention by applied researchers and major
software vendors for C and C++ code. Some publicly-reported vulnerabilities probably have
type confusion as a root-cause weakness, but these may be described as "memory corruption"
instead. For other languages, there are very few public reports of type confusion weaknesses.
These are probably under-studied. Since many programs rely directly or indirectly on loose
typing, a potential "type confusion" behavior might be intentional, possibly requiring more manual
analysis.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding EXP39-C Exact Do not access a variable through a
pointer of an incompatible type
References
[REF-811]Mark Dowd, Ryan Smith and David Dewey. "Attacking Interoperability". 2009. < http://
hustlelabs.com/stuff/bh2009_dowd_smith_dewey.pdf >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-862: Missing Authorization
Weakness ID : 862
Structure : Simple
Abstraction : Class
Description
The product does not perform an authorization check when an actor attempts to access a resource
or perform an action.
Extended Description
Assuming a user with a given identity, authorization is the process of determining whether that user
can access a given resource, based on the user's privileges and any permissions or other accesscontrol
specifications that apply to the resource.
When access control checks are not applied, users are able to access data or perform actions
that they should not be allowed to perform. This can lead to a wide range of problems, including
information exposures, denial of service, and arbitrary code execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 285 Improper Authorization 684
ParentOf 425 Direct Request ('Forced Browsing') 1025
ParentOf 638 Not Using Complete Mediation 1404
CWE Version 4.14
CWE-862: Missing Authorization
CWE-862: Missing Authorization