246
Nature Type ID Name Page
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Relationship
Resource injection that involves resources stored on the filesystem goes by the name path
manipulation (CWE-73).
Maintenance
The relationship between CWE-99 and CWE-610 needs further investigation and clarification.
They might be duplicates. CWE-99 "Resource Injection," as originally defined in Seven
Pernicious Kingdoms taxonomy, emphasizes the "identifier used to access a system resource"
such as a file name or port number, yet it explicitly states that the "resource injection" term does
not apply to "path manipulation," which effectively identifies the path at which a resource can
be found and could be considered to be one aspect of a resource identifier. Also, CWE-610
effectively covers any type of resource, whether that resource is at the system layer, the
application layer, or the code layer.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Resource Injection
Software Fault Patterns SFP24 Tainted input to command
OMG ASCSM ASCSMCWE-