1288
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP25 Tainted input to variable
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context
Weakness ID : 567
Structure : Simple
Abstraction : Base
Description
The product does not properly synchronize shared data, such as static variables across threads,
which can lead to undefined behavior and unpredictable data changes.
Extended Description
Within servlets, shared static variables are not protected from concurrent access, but servlets are
multithreaded. This is a typical programming mistake in J2EE applications, since the multithreading
is handled by the framework. When a shared variable can be influenced by an attacker, one thread
could wind up modifying the variable to contain data that is not valid for a different thread that is
also using the data within the variable.
Note that this weakness is not unique to servlets.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 820 Missing Synchronization 1720
CanPrecede 488 Exposure of Data Element to Wrong Session 1169
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ChildOf 662 Improper Synchronization 1448
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 662 Improper Synchronization 1448
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Read Application Data
Modify Application Data
DoS: Instability
DoS: Crash, Exit, or Restart
CWE Version 4.14
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context