1121
Reference Description
CVE-2004-2331 Database system allows attackers to bypass sandbox restrictions by using the
Reflection API.
https://www.cve.org/CVERecord?id=CVE-2004-2331
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 884 CWE Cross-section 884 2567
MemberOf 991 SFP Secondary Cluster: Tainted Input to Environment 888 2416
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Unsafe Reflection
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC06-J Do not use reflection to increase
accessibility of classes, methods, or
fields
Related Attack Patterns
CAPEC-ID Attack Pattern Name
138 Reflection Injection
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-471: Modification of Assumed-Immutable Data (MAID)
Weakness ID : 471
Structure : Simple
Abstraction : Base
Description
The product does not properly protect an assumed-immutable element from being modified by an
attacker.
Extended Description
This occurs when a particular input is critical enough to the functioning of the application that it
should not be modifiable at all, but it is. Certain resources are often assumed to be immutable
when they are not, such as hidden form fields in web applications, cookies, and reverse DNS
lookups.
Relationships
CWE Version 4.14
CWE-471: Modification of Assumed-Immutable Data (MAID)
CWE-471: Modification of Assumed-Immutable Data (MAID)