1475
echo json_encode($record);
}
The programmer is careful to not display the user's e-mail address when displaying the public
HTML page. However, the e-mail address is not removed from the JSON response, exposing the
user's e-mail address.
Observed Examples
Reference Description
CVE-2021-22909 Chain: router's firmware update procedure uses curl with "-k" (insecure) option
that disables certificate validation (CWE-295), allowing adversary-in-the-middle
(AITM) compromise with a malicious firmware image (CWE-494).
https://www.cve.org/CVERecord?id=CVE-2021-22909
CVE-2023-5227 PHP-based FAQ management app does not check the MIME type for
uploaded images
https://www.cve.org/CVERecord?id=CVE-2023-5227
CVE-2005-0406 Some image editors modify a JPEG image, but the original EXIF thumbnail
image is left intact within the JPEG. (Also an interaction error).
https://www.cve.org/CVERecord?id=CVE-2005-0406
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
CWE-670: Always-Incorrect Control Flow Implementation
Weakness ID : 670
Structure : Simple
Abstraction : Class
Description
The code contains a control flow path that does not reflect the algorithm that the path is intended to
implement, leading to incorrect behavior any time this path is navigated.
Extended Description
This weakness captures cases in which a particular code segment is always incorrect with respect
to the algorithm that it is implementing. For example, if a C programmer intends to include multiple
statements in a single block but does not include the enclosing braces (CWE-483), then the logic is
always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves
correctly, except when it is externally manipulated in malicious ways.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-670: Always-Incorrect Control Flow Implementation
CWE-670: Always-Incorrect Control Flow Implementation