1400
ReportAuth($username, $result, 0);
DoReallyImportantStuff();
}
Example 3:
In the following Java snippet, the accessGranted() method is accidentally called with the static
ADMIN_ROLES array rather than the user roles.
Example Language: Java (Bad)
private static final String[] ADMIN_ROLES = ...;
public boolean void accessGranted(String resource, String user) {
String[] userRoles = getUserRoles(user);
return accessGranted(resource, ADMIN_ROLES);
}
private boolean void accessGranted(String resource, String[] userRoles) {
// grant or deny access based on user roles
...
}
Observed Examples
Reference Description
CVE-2006-7049 The method calls the functions with the wrong argument order, which allows
remote attackers to bypass intended access restrictions.
https://www.cve.org/CVERecord?id=CVE-2006-7049
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 736 CERT C Secure Coding Standard (2008) Chapter 3 -
Declarations and Initialization (DCL)
734 2341
MemberOf 737 CERT C Secure Coding Standard (2008) Chapter 4 -
Expressions (EXP)
734 2341
MemberOf 742 CERT C Secure Coding Standard (2008) Chapter 9 -
Memory Management (MEM)
734 2345
MemberOf 884 CWE Cross-section 884 2567
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1157 SEI CERT C Coding Standard - Guidelines 03.
Expressions (EXP)
1154 2455
MemberOf 1180 SEI CERT Perl Coding Standard - Guidelines 02.
Declarations and Initialization (DCL)
1178 2465
MemberOf 1181 SEI CERT Perl Coding Standard - Guidelines 03.
Expressions (EXP)
1178 2466
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding DCL10-C Maintain the contract between the
writer and caller of variadic functions
CERT C Secure Coding EXP37-C CWE More
Abstract
Call functions with the correct number
and type of arguments
SEI CERT Perl Coding
Standard
DCL00-
PL
CWE More
Abstract
Do not use subroutine prototypes
CWE Version 4.14
CWE-636: Not Failing Securely ('Failing Open')
CWE-636: Not Failing Securely ('Failing Open')