17
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Sensitive memory uncleared by
compiler optimization
OWASP Top Ten 2004 A8 CWE More Specific Insecure Storage
CERT C Secure Coding MSC06-
C
Be aware of compiler optimization when
dealing with sensitive data
Software Fault Patterns SFP23 Exposed Data
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-124]Michael Howard. "When scrubbing secrets in memory doesn't work". BugTraq. 2002
November 5. < http://cert.uni-stuttgart.de/archive/bugtraq/2002/11/msg00046.html >.
[REF-125]Michael Howard. "Some Bad News and Some Good News". 2002 October 1. Microsoft. <
https://learn.microsoft.com/en-us/previous-versions/ms972826(v=msdn.10) >.2023-04-07.
[REF-126]Joseph Wagner. "GNU GCC: Optimizer Removes Code Necessary for Security".
Bugtraq. 2002 November 6. < https://seclists.org/bugtraq/2002/Nov/266 >.2023-04-07.
CWE-15: External Control of System or Configuration Setting
Weakness ID : 15
Structure : Simple
Abstraction : Base
Description
One or more system settings or configuration elements can be externally controlled by a user.
Extended Description
Allowing external control of system settings can disrupt service or cause an application to behave
in unexpected, and potentially malicious ways.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 610 Externally Controlled Reference to a Resource in Another
Sphere