99
Related Attack Patterns
CAPEC-ID Attack Pattern Name
10 Buffer Overflow via Environment Variables
75 Manipulating Writeable Configuration Files
240 Resource Injection
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-102: Struts: Duplicate Validation Forms
Weakness ID : 102
Structure : Simple
Abstraction : Variant
Description
The product uses multiple validation forms with the same name, which might cause the Struts
Validator to validate a form that the programmer does not expect.
Extended Description
If two validation forms have the same name, the Struts Validator arbitrarily chooses one of the
forms to use for input validation and discards the other. This decision might not correspond to the
CWE Version 4.14
CWE-102: Struts: Duplicate Validation Forms
CWE-102: Struts: Duplicate Validation Forms