1173
<INPUT TYPE=TEXT name=username>
<INPUT TYPE=PASSWORD name=password>
<INPUT TYPE=SUBMIT>
</FORM>
Then a conforming link will look like:
Example Language: (Informative)
http://TARGET/authenticate_login.cgi?username=...&password=...
An attacker can change this to:
Example Language: (Attack)
http://TARGET/authenticate_login.cgi?username=&password=&debug=1
Which will grant the attacker access to the site, bypassing the authentication process.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 485 7PK - Encapsulation 700 2328
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1371 ICS Supply Chain: Poorly Documented or
Undocumented Features
1358 2508
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Other
In J2EE a main method may be a good indicator that debug code has been left in the application,
although there may not be any direct security impact.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Leftover Debug Code
OWASP Top Ten 2004 A10 CWE More Specific Insecure Configuration Management
Software Fault Patterns SFP28 Unexpected access points
Related Attack Patterns
CAPEC-ID Attack Pattern Name
121 Exploit Non-Production Interfaces
661 Root/Jailbreak Detection Evasion via Debugging
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE Version 4.14
CWE-491: Public cloneable() Method Without Final ('Object Hijack')
CWE-491: Public cloneable() Method Without Final ('Object Hijack')