1383
Nature Type ID Name Page
MemberOf 399 Resource Management Errors 2324
Weakness Ordinalities
Primary : This could be primary when the programmer never attempts to close the cursor
when finished with it.
Resultant :
Applicable Platforms
Language : SQL (Prevalence = Undetermined)
Background Details
A cursor is a feature in Oracle PL/SQL and other languages that provides a handle for executing
and accessing the results of SQL queries.
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
Potential Mitigations
Phase: Implementation
Close cursors immediately after access to them is complete. Ensure that you close cursors if
exceptions occur.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP24 Tainted input to command
References
[REF-505]David Litchfield. "The Oracle Hacker's Handbook".
[REF-506]David Litchfield. "Cursor Injection". < http://www.davidlitchfield.com/cursor-injection.pdf
>.2023-04-07.
CWE-620: Unverified Password Change
Weakness ID : 620
Structure : Simple
Abstraction : Base
Description
When setting a new password for a user, the product does not require knowledge of the original
password, or using another form of authentication.
Extended Description
CWE Version 4.14
CWE-620: Unverified Password Change
CWE-620: Unverified Password Change