1034
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
PeerOf 426 Untrusted Search Path 1028
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1219 File Handling Issues 2480
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Alternate Terms
DLL preloading : This term is one of several that are used to describe exploitation of untrusted
search path elements in Windows systems, which received wide attention in August 2010. From a
weakness perspective, the term is imprecise because it can apply to both CWE-426 and CWE-427.
Binary planting : This term is one of several that are used to describe exploitation of untrusted
search path elements in Windows systems, which received wide attention in August 2010. From a
weakness perspective, the term is imprecise because it can apply to both CWE-426 and CWE-427.
Insecure library loading : This term is one of several that are used to describe exploitation of
untrusted search path elements in Windows systems, which received wide attention in August
2010. From a weakness perspective, the term is imprecise because it can apply to both CWE-426
and CWE-427.
Dependency confusion : As of February 2021, this term is used to describe CWE-427 in the
context of managing installation of software package dependencies, in which attackers release
packages on public sites where the names are the same as package names used by private
repositories, and the search for the dependent package tries the public site first, downloading
untrusted code. It may also be referred to as a "substitution attack."
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
CWE Version 4.14
CWE-427: Uncontrolled Search Path Element
CWE-427: Uncontrolled Search Path Element