996
Scope Impact Likelihood
System resources, CPU and memory, can be quickly
consumed. This can lead to poor system performance or
system crash.
Demonstrative Examples
Example 1:
This function prints the contents of a specified file requested by a user.
Example Language: PHP (Bad)
function printFile($username,$filename){
//read file into string
$file = file_get_contents($filename);
if ($file && isOwnerOf($username,$filename)){
echo $file;
return true;
}
else{
echo 'You are not authorized to view this file';
}
return false;
}
This code first reads a specified file into memory, then prints the file if the user is authorized to see
its contents. The read of the file into memory may be resource intensive and is unnecessary if the
user is not allowed to see the file anyway.
Observed Examples
Reference Description
CVE-2004-2458 Tool creates directories before authenticating user.
https://www.cve.org/CVERecord?id=CVE-2004-2458
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 977 SFP Secondary Cluster: Design 888 2407
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Notes
Relationship
Overlaps authentication errors.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Early Amplification
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Weakness ID : 409
Structure : Simple
Abstraction : Base
CWE Version 4.14
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)