243
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1215 Data Validation Issues 2478
MemberOf 137 Data Neutralization Issues 2311
MemberOf 399 Resource Management Errors 2324
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Execution of arbitrary code in the context of usage of the
resources with dangerous names.
Confidentiality
Availability
Read Application Data
DoS: Crash, Exit, or Restart
Crash of the consumer code of these resources resulting in
information leakage or denial of service.
Potential Mitigations
Phase: Architecture and Design
Do not allow users to control names of resources used on the server side.
Phase: Architecture and Design
Perform allowlist input validation at entry points and also before consuming the resources. Reject
bad file names rather than trying to cleanse them.
Phase: Architecture and Design
Make sure that technologies consuming the resources are not vulnerable (e.g. buffer overflow,
format string, etc.) in a way that would allow code execution if the name of the resource is
malformed.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Taxonomy Mappings
CWE Version 4.14
CWE-642: External Control of Critical State Data
CWE-642: External Control of Critical State Data