849
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-320]Michal Zalewski. "Strange Attractors and TCP/IP Sequence Number Analysis". 2001. <
https://lcamtuf.coredump.cx/oldtcp/tcpseq.html >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-344: Use of Invariant Value in Dynamically Changing Context
Weakness ID : 344
Structure : Simple
Abstraction : Base
Description
The product uses a constant value, name, or reference, but this value can (or should) vary across
different environments.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 330 Use of Insufficiently Random Values 814
ParentOf 323 Reusing a Nonce, Key Pair in Encryption 790
ParentOf 587 Assignment of a Fixed Address to a Pointer 1322
ParentOf 798 Use of Hard-coded Credentials 1690
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1213 Random Number Issues 2477
Weakness Ordinalities
Primary :
Resultant :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Demonstrative Examples
Example 1:
The following code is an example of an internal hard-coded password in the back-end:
Example Language: C (Bad)
int VerifyAdmin(char *password) {
if (strcmp(password, "Mew!")) {
CWE Version 4.14
CWE-344: Use of Invariant Value in Dynamically Changing Context
CWE-344: Use of Invariant Value in Dynamically Changing Context