920
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
This conceptually overlaps other categories such as insufficient verification, but this entry refers
to the product's incorrect perception of its own state.
Relationship
This is probably resultant from other weaknesses such as unhandled error conditions, inability to
handle out-of-order steps, multiple interpretation errors, etc.
Maintenance
This entry is being considered for deprecation. It was poorly-defined in PLOVER and is not easily
described using the behavior/resource/property model of vulnerability theory.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Incomplete Internal State Distinction
Related Attack Patterns
CAPEC-ID Attack Pattern Name
74 Manipulating State
140 Bypassing of Intermediate Forms in Multiple-Form Sets
CWE-374: Passing Mutable Objects to an Untrusted Method
Weakness ID : 374
Structure : Simple
Abstraction : Base
Description
The product sends non-cloned mutable data as an argument to a method or function.
Extended Description
The function or method that has been called can alter or delete the mutable data. This could violate
assumptions that the calling function has made about its state. In situations where unknown code
is called with references to mutable data, this external code could make changes to the data
sent. If this data was not previously cloned, the modified data might not be valid in the context of
execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 371 State Issues 2321
CWE Version 4.14
CWE-374: Passing Mutable Objects to an Untrusted Method
CWE-374: Passing Mutable Objects to an Untrusted Method