728
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
ChildOf 295 Improper Certificate Validation 714
ParentOf 370 Missing Check for Certificate Revocation after Initial Check 917
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1014 Identify Actors 2429
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Trust may be assigned to an entity who is not who it claims
to be.
Integrity
Other
Other
Data from an untrusted (and possibly malicious) source
may be integrated.
Confidentiality Read Application Data
Data may be disclosed to an entity impersonating a trusted
entity, resulting in information disclosure.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Ensure that certificates are checked for revoked status.
Phase: Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully
validated before the certificate is pinned, including the revoked status.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-299: Improper Check for Certificate Revocation
CWE-299: Improper Check for Certificate Revocation