1412
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
This entry might be reclassified as a category or "loose composite," since it lists multiple specific
errors that can make the mechanism weak. However, under view 1000, it could be a weakness
under protection mechanism failure, although it is different from most PMF issues since it is
related to a feature that is designed to bypass a protection mechanism (specifically, the lack of
knowledge of a password).
Maintenance
This entry probably needs to be split; see extended description.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 49 Insufficient Password Recovery
Related Attack Patterns
CAPEC-ID Attack Pattern Name
50 Password Recovery Exploitation
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-641: Improper Restriction of Names for Files and Other Resources
Weakness ID : 641
Structure : Simple
Abstraction : Base
Description
The product constructs the name of a file or other resource using input from an upstream
component, but it does not restrict or incorrectly restricts the resulting name.
Extended Description
This may produce resultant weaknesses. For instance, if the names of these resources contain
scripting characters, it is possible that a script may get executed in the client's browser if the
application ever displays the name of the resource on a dynamically generated web page.
Alternately, if the resources are consumed by some application parser, a specially crafted name
can exploit some vulnerability internal to the parser, potentially resulting in execution of arbitrary
code on the server machine. The problems will vary based on the context of usage of such
malformed resource names and whether vulnerabilities are present in or assumptions are made by
the targeted technology that would make code execution possible.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-641: Improper Restriction of Names for Files and Other Resources
CWE-641: Improper Restriction of Names for Files and Other Resources