1085
Notes
Maintenance
This overlaps other categories, probably should be split into separate items.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insecure default variable initialization
CWE-454: External Initialization of Trusted Variables or Data Stores
Weakness ID : 454
Structure : Simple
Abstraction : Base
Description
The product initializes critical internal variables or data stores using inputs that can be modified by
untrusted actors.
Extended Description
A product system should be reluctant to trust variables that have been initialized outside of its
trust boundary, especially if they are initialized by users. The variables may have been initialized
incorrectly. If an attacker can initialize the variable, then they can influence what the vulnerable
system will do.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1419 Incorrect Initialization of Resource 2280
CanAlsoBe 456 Missing Initialization of a Variable 1089
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 452 Initialization and Cleanup Errors 2327
Applicable Platforms
Language : PHP (Prevalence = Sometimes)
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
An attacker could gain access to and modify sensitive data
or system information.
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
CWE Version 4.14
CWE-454: External Initialization of Trusted Variables or Data Stores
CWE-454: External Initialization of Trusted Variables or Data Stores