1806
Scope Impact Likelihood
Other
Integrity
Varies by Context
Alter Execution Logic
Detection Methods
Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs
- either randomly or algorithmically - and dynamically invoking the code with those inputs.
Even with random inputs, it is often capable of generating unexpected results such as crashes,
memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases
that clearly indicate bugs, which helps developers to diagnose the issues.
Effectiveness = High
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
For any externally-influenced input, check the input against an allowlist of acceptable values.
Phase: Implementation
Phase: Architecture and Design
Strategy = Refactoring
Refactor the code so that it does not need to be dynamically managed.
Observed Examples
Reference Description
CVE-2022-2054 Python compiler uses eval() to execute malicious strings as Python code.
https://www.cve.org/CVERecord?id=CVE-2022-2054
CVE-2018-1000613Cryptography API uses unsafe reflection when deserializing a private key
https://www.cve.org/CVERecord?id=CVE-2018-1000613
CVE-2015-8103 Deserialization issue in commonly-used Java library allows remote execution.
https://www.cve.org/CVERecord?id=CVE-2015-8103
CVE-2006-7079 Chain: extract used for register_globals compatibility layer, enables path
traversal (CWE-22)
https://www.cve.org/CVERecord?id=CVE-2006-7079
CVE-2012-2055 Source version control product allows modification of trusted key using mass
assignment.
https://www.cve.org/CVERecord?id=CVE-2012-2055
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
CWE Version 4.14
CWE-914: Improper Control of Dynamically-Identified Variables
CWE-914: Improper Control of Dynamically-Identified Variables