1263
Nature Type ID Name Page
MemberOf 355 User Interface Security Issues 2320
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Phase: Requirements
Recommendations include requiring all password fields in your web application be masked to
prevent other users from seeing this information.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 995 SFP Secondary Cluster: Feature 888 2418
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-550: Server-generated Error Message Containing Sensitive Information
Weakness ID : 550
Structure : Simple
Abstraction : Variant
Description
Certain conditions, such as network failure, will cause a server error message to be displayed.
Extended Description
While error messages in and of themselves are not dangerous, per se, it is what an attacker can
glean from them that might cause eventual problems.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-551: Incorrect Behavior Order: Authorization
Before Parsing and Canonicalization 1264
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 209 Generation of Error Message Containing Sensitive
Information