1032
Reference Description
CVE-2008-2613 setuid program allows compromise using path that finds and loads a malicious
library.
https://www.cve.org/CVERecord?id=CVE-2008-2613
CVE-2008-1319 Server allows client to specify the search path, which can be modified to point
to a program that the client has uploaded.
https://www.cve.org/CVERecord?id=CVE-2008-1319
Functional Areas
• Program Invocation
• Code Libraries
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 744 CERT C Secure Coding Standard (2008) Chapter 11 -
Environment (ENV)
734 2348
MemberOf 752 2009 Top 25 - Risky Resource Management 750 2353
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 878 CERT C++ Secure Coding Section 10 - Environment
(ENV)
868 2378
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Untrusted Search Path
CLASP Relative path library search
CERT C Secure Coding ENV03-C Sanitize the environment when invoking
external programs
Related Attack Patterns
CAPEC-ID Attack Pattern Name
38 Leveraging/Manipulating Configuration File Search Paths
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-176]Michael Howard and David LeBlanc. "Writing Secure Code". 1st Edition. 2001 November
3. Microsoft Press.
[REF-207]John Viega and Gary McGraw. "Building Secure Software: How to Avoid Security
Problems the Right Way". 1st Edition. 2002. Addison-Wesley.
CWE Version 4.14
CWE-427: Uncontrolled Search Path Element
CWE-427: Uncontrolled Search Path Element