2313
Nature Type ID Name Page
HasMember 212 Improper Removal of Sensitive Information Before
Storage or Transfer
699 544
HasMember 213 Exposure of Sensitive Information Due to Incompatible
Policies
699 547
HasMember 214 Invocation of Process Using Visible Sensitive
Information
699 549
HasMember 215 Insertion of Sensitive Information Into Debugging Code 699 551
HasMember 312 Cleartext Storage of Sensitive Information 699 764
HasMember 319 Cleartext Transmission of Sensitive Information 699 779
HasMember 359 Exposure of Private Personal Information to an
Unauthorized Actor
699 882
HasMember 497 Exposure of Sensitive System Information to an
Unauthorized Control Sphere
699 1193
HasMember 524 Use of Cache Containing Sensitive Information 699 1232
HasMember 538 Insertion of Sensitive Information into Externally-
Accessible File or Directory
699 1248
HasMember 921 Storage of Sensitive Data in a Mechanism without
Access Control
699 1824
HasMember 1230 Exposure of Sensitive Information Through Metadata 699 2006
Category-227: 7PK - API Abuse
Category ID : 227
Summary
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability
classification. It includes weaknesses that involve the software using an API in a manner contrary
to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a
contract between a caller and a callee. The most common forms of API misuse occurs when
the caller does not honor its end of this contract. For example, if a program does not call chdir()
after calling chroot(), it violates the contract that specifies how to change the active root directory
in a secure fashion. Another good example of library abuse is expecting the callee to return
trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making
certain assumptions about its behavior (that the return value can be used for authentication
purposes). One can also violate the caller-callee contract from the other side. For example, if a
coder subclasses SecureRandom and returns a non-random value, the contract is violated."
Membership
Nature Type ID Name Page
MemberOf 700 Seven Pernicious Kingdoms 700 2557
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
HasMember 242 Use of Inherently Dangerous Function 700 586
HasMember 243 Creation of chroot Jail Without Changing Working
Directory
700 589
HasMember 244 Improper Clearing of Heap Memory Before Release
('Heap Inspection')
700 591
HasMember 245 J2EE Bad Practices: Direct Management of
Connections
700 592
HasMember 246 J2EE Bad Practices: Direct Use of Sockets 700 594
HasMember 248 Uncaught Exception 700 596
HasMember 250 Execution with Unnecessary Privileges 700 599
CWE Version 4.14
CWE-251: Often Misused: String Management
CWE-251: Often Misused: String Management