1171
Nature Type ID Name Page
MemberOf 882 CERT C++ Secure Coding Section 14 - Concurrency
(CON)
868 2380
MemberOf 965 SFP Secondary Cluster: Insecure Session Management 888 2403
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Data Leaking Between Users
Related Attack Patterns
CAPEC-ID Attack Pattern Name
59 Session Credential Falsification through Prediction
60 Reusing Session IDs (aka Session Replay)
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-489: Active Debug Code
Weakness ID : 489
Structure : Simple
Abstraction : Base
Description
The product is deployed to unauthorized actors with debugging code still enabled or active, which
can create unintended entry points or expose sensitive information.
Extended Description
A common development practice is to add "back door" code specifically designed for debugging or
testing purposes that is not intended to be shipped or deployed with the product. These back door
entry points create security risks because they are not considered during design or testing and fall
outside of the expected operating conditions of the product.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 710 Improper Adherence to Coding Standards 1549
ParentOf 11 ASP.NET Misconfiguration: Creating Debug Binary 9
CanPrecede 215 Insertion of Sensitive Information Into Debugging Code 551
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1006 Bad Coding Practices 2422
Weakness Ordinalities
CWE Version 4.14
CWE-489: Active Debug Code
CWE-489: Active Debug Code