1823
[REF-918]Vladimir Vorontsov and Alexander Golovko. "SSRF attacks and sockets: smorgasbord
of vulnerabilities". < https://www.slideshare.net/DefconRussia/vorontsov-golovko-ssrf-attacks-andsockets-
smorgasbord-of-vulnerabilities >.2023-04-07.
[REF-919]ONsec Lab. "SSRF bible. Cheatsheet". 2013 January 6. < https://docs.google.com/
document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit?pli=1# >.
[REF-920]Deral Heiland. "Web Portals: Gateway To Information, Or A Hole In Our Perimeter
Defenses". 2008 February. < http://www.shmoocon.org/2008/presentations/Web%20portals,
%20gateway%20to%20information.ppt >.
CWE-920: Improper Restriction of Power Consumption
Weakness ID : 920
Structure : Simple
Abstraction : Base
Description
The product operates in an environment in which power is a limited resource that cannot be
automatically replenished, but the product does not properly restrict the amount of power that its
operation consumes.
Extended Description
In environments such as embedded or mobile devices, power can be a limited resource such as
a battery, which cannot be automatically replenished by the product itself, and the device might
not always be directly attached to a reliable power source. If the product uses too much power
too quickly, then this could cause the device (and subsequently, the product) to stop functioning
until power is restored, or increase the financial burden on the device owner because of increased
power costs.
Normal operation of an application will consume power. However, in some cases, an attacker could
cause the application to consume more power than intended, using components such as:
• Display
• CPU
• Disk I/O
• GPS
• Sound
• Microphone
• USB interface
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 400 Uncontrolled Resource Consumption 964
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 400 Uncontrolled Resource Consumption 964
CWE Version 4.14
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control