1088
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Other
Modify Application Data
Alter Execution Logic
The application could be placed in an insecure state that
may allow an attacker to modify sensitive data or allow
unintended logic to be executed.
Potential Mitigations
Phase: Implementation
Follow the principle of failing securely when an error occurs. The system should enter a state
where it is not vulnerable and will not display sensitive error messages to a potential attacker.
Demonstrative Examples
Example 1:
The following code intends to limit certain operations to the administrator only.
Example Language: Perl (Bad)
$username = GetCurrentUser();
$state = GetStateData($username);
if (defined($state)) {
$uid = ExtractUserID($state);
}
# do stuff
if ($uid == 0) {
DoAdminThings();
}
If the application is unable to extract the state information - say, due to a database timeout - then
the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as
equivalent to "0" in the conditional, allowing the original user to perform administrator actions. Even
if the attacker cannot directly influence the state data, unexpected errors could cause incorrect
privileges to be assigned to a user just by accident.
Observed Examples
Reference Description
CVE-2005-1345 Product does not trigger a fatal error if missing or invalid ACLs are in a
configuration file.
https://www.cve.org/CVERecord?id=CVE-2005-1345
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 961 SFP Secondary Cluster: Incorrect Exception Behavior 888 2399
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Notes
Research Gap
CWE Version 4.14
CWE-456: Missing Initialization of a Variable
CWE-456: Missing Initialization of a Variable