434
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
References
[REF-422]Richard Stanway (r1CH). "Dynamic File Uploads, Security and You". < https://
web.archive.org/web/20090208005456/http://shsc.info/FileUploadSecurity >.2023-04-07.
[REF-423]Johannes Ullrich. "8 Basic Rules to Implement Secure File Uploads". 2009 December 8.
< https://www.sans.org/blog/8-basic-rules-to-implement-secure-file-uploads/ >.2023-04-07.
[REF-424]Johannes Ullrich. "Top 25 Series - Rank 8 - Unrestricted Upload of Dangerous File
Type". 2010 February 5. SANS Software Security Institute. < https://www.sans.org/blog/top-25-
series-rank-8-unrestricted-upload-of-dangerous-file-type/ >.2023-04-07.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities
Weakness ID : 435
Structure : Simple
Abstraction : Pillar
Description
An interaction error occurs when two entities have correct behavior when running independently
of each other, but when they are integrated as components in a larger system or process, they
introduce incorrect behaviors that may cause resultant weaknesses.
Extended Description
When a system or process combines multiple independent components, this often produces new,
emergent behaviors at the system level. However, if the interactions between these components
are not fully accounted for, some of the emergent behaviors can be incorrect or even insecure.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities
CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities