561
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Omission of Security-relevant
Information
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-224: Obscured Security-relevant Information by Alternate Name
Weakness ID : 224
Structure : Simple
Abstraction : Base
Description
The product records security-relevant information according to an alternate name of the affected
entity, instead of the canonical name.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 221 Information Loss or Omission 556
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1009 Audit 2424
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1210 Audit / Logging Errors 2475
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Non-Repudiation
Access Control
Hide Activities
Gain Privileges or Assume Identity
Demonstrative Examples
Example 1:
This code prints the contents of a file if a user has permission.
Example Language: PHP (Bad)
function readFile($filename){
$user = getCurrentUser();
$realFile = $filename;
//resolve file if its a symbolic link
CWE Version 4.14
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-226: Sensitive Information in Resource Not Removed Before Reuse