2207
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
77 Manipulating User-Controlled Variables
180 Exploiting Incorrectly Configured Access Control Security Levels
References
[REF-1148]Olivier Arteau. "Prototype pollution attack in NodeJS application". 2018
May 5. < https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/
JavaScript_prototype_pollution_attack_in_NodeJS.pdf >.
[REF-1149]Changhui Xu. "What is Prototype Pollution?". 2019 July 0. < https://codeburst.io/whatis-
prototype-pollution-49482fc4b638 >.
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context
Weakness ID : 1322
Structure : Simple
Abstraction : Base
Description
The product uses a non-blocking model that relies on a single threaded process for features such
as scalability, but it contains code that can block when it is invoked.
Extended Description
When an attacker can directly invoke the blocking code, or the blocking code can be affected by
environmental conditions that can be influenced by an attacker, then this can lead to a denial of
service by causing unexpected hang or freeze of the code. Examples of blocking code might be
an expensive computation or calling blocking library calls, such as those that perform exclusive file
operations or require a successful network operation.
Due to limitations in multi-thread models, single-threaded models are used to overcome the
resource constraints that are caused by using many threads. In such a model, all code should
generally be non-blocking. If blocking code is called, then the event loop will effectively be stopped,
which can be undesirable or dangerous. Such models are used in Python asyncio, Vert.x, and
Node.js, or other custom event loop code.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 834 Excessive Iteration 1754
CanPrecede 835 Loop with Unreachable Exit Condition ('Infinite Loop') 1757
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-1323: Improper Management of Sensitive Trace Data
CWE-1323: Improper Management of Sensitive Trace Data