1401
Mapped Taxonomy Name Node ID Fit Mapped Node Name
SEI CERT Perl Coding
Standard
EXP33-
PL
Imprecise Do not invoke a function in a context for
which it is not defined
CWE-636: Not Failing Securely ('Failing Open')
Weakness ID : 636
Structure : Simple
Abstraction : Class
Description
When the product encounters an error condition or failure, its design requires it to fall back to
a state that is less secure than other options that are available, such as selecting the weakest
encryption algorithm or using the most permissive access control restrictions.
Extended Description
By entering a less secure state, the product inherits the weaknesses associated with that state,
making it easier to compromise. At the least, it causes administrators to have a false sense of
security. This weakness typically occurs as a result of wanting to "fail functional" to minimize
administration and support costs, instead of "failing safe."
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 755 Improper Handling of Exceptional Conditions 1576
ChildOf 657 Violation of Secure Design Principles 1446
ParentOf 455 Non-exit on Failed Initialization 1087
PeerOf 280 Improper Handling of Insufficient Permissions or Privileges 672
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Alternate Terms
Failing Open :
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Intended access restrictions can be bypassed, which is
often contradictory to what the product's administrator
expects.
Potential Mitigations
Phase: Architecture and Design
CWE Version 4.14
CWE-636: Not Failing Securely ('Failing Open')
CWE-636: Not Failing Securely ('Failing Open')