2279
urgent mitigation in many organizations. However, it was unclear how many products were
affected, as Log4j would sometimes be part of a long sequence of transitive dependencies.
[REF-1316]
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 4-2 Req CR 2.4
ISA/IEC 62443 Part 4-2 Req CR 6.2
ISA/IEC 62443 Part 4-2 Req CR 7.2
ISA/IEC 62443 Part 4-1 Req SM-9
ISA/IEC 62443 Part 4-1 Req SM-10
ISA/IEC 62443 Part 4-1 Req SR-2
ISA/IEC 62443 Part 4-1 Req DM-1
ISA/IEC 62443 Part 4-1 Req DM-3
ISA/IEC 62443 Part 4-1 Req DM-4
ISA/IEC 62443 Part 4-1 Req SVV-1
ISA/IEC 62443 Part 4-1 Req SVV-3
References
[REF-1313]Jeff Williams, Arshan Dabirsiaghi. "The Unfortunate Reality of Insecure Libraries". 2014.
< https://owasp.org/www-project-dependency-check/ >.2023-01-25.
[REF-1212]"A06:2021 - Vulnerable and Outdated Components". 2021 September 4. OWASP. <
https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/ >.
[REF-1247]NTIA Multistakeholder Process on Software Component Transparency Framing
Working Group. "Framing Software Component Transparency: Establishing a Common Software
Bill of Materials (SBOM)". 2021 October 1. < https://www.ntia.gov/files/ntia/publications/
ntia_sbom_framing_2nd_edition_20211021.pdf >.
[REF-1311]Amélie Koran, Wendy Nather, Stewart Scott, Sara Ann Brackett. "The Cases for
Using the SBOMs We Build". 2022 November. < https://www.atlanticcouncil.org/wp-content/
uploads/2022/11/AC_SBOM_IB_v2-002.pdf >.2023-01-25.
[REF-1312]OWASP. "OWASP Dependency-Check". < https://owasp.org/www-project-dependencycheck/
>.2023-01-25.
[REF-1314]ICS-CERT. "ICS Alert (ICS-ALERT-20-063-01): SweynTooth Vulnerabilities". 2020
March 4. < https://www.cisa.gov/news-events/ics-alerts/ics-alert-20-063-01 >.2023-04-07.
[REF-1315]Matheus E. Garbelini, Sudipta Chattopadhyay, Chundong Wang, Singapore University
of Technology and Design. "Unleashing Mayhem over Bluetooth Low Energy". 2020 March 4. <
https://asset-group.github.io/disclosures/sweyntooth/ >.2023-01-25.
[REF-1316]CISA. "Alert (AA21-356A): Mitigating Log4Shell and Other Log4j-Related
Vulnerabilities". 2021 December 2. < https://www.cisa.gov/news-events/cybersecurity-advisories/
aa21-356a >.2023-04-07.
[REF-1317]SC Media. "What Log4Shell taught us about application security, and how to respond
now". 2022 July 5. < https://www.scmagazine.com/resource/application-security/what-log4shelltaught-
us-about-appsec-and-how-to-respond >.2023-01-26.
CWE Version 4.14
CWE-1419: Incorrect Initialization of Resource
CWE-1419: Incorrect Initialization of Resource