784
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 751 2009 Top 25 - Insecure Interaction Between
Components
750 2352
MemberOf 818 OWASP Top Ten 2010 Category A9 - Insufficient
Transport Layer Protection
809 2359
MemberOf 858 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 15 - Serialization (SER)
844 2368
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 884 CWE Cross-section 884 2567
MemberOf 934 OWASP Top Ten 2013 Category A6 - Sensitive Data
Exposure
928 2391
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1029 OWASP Top Ten 2017 Category A3 - Sensitive Data
Exposure
1026 2436
MemberOf 1148 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 14. Serialization (SER)
1133 2451
MemberOf 1207 Debug and Test Problems 1194 2474
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Maintenance
The Taxonomy_Mappings to ISA/IEC 62443 were added in CWE 4.10, but they are still under
review and might change in future CWE versions. These draft mappings were performed by
members of the "Mapping CWE to 62443" subgroup of the CWE-CAPEC ICS/OT Special Interest
Group (SIG), and their work is incomplete as of CWE 4.10. The mappings are included to
facilitate discussion and review by the broader ICS/OT community, and they are likely to change
in future CWE versions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Plaintext Transmission of Sensitive
Information
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC06-J Do not rely on the default automatic
signature verification provided by
URLClassLoader and java.util.jar
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER02-J Sign then seal sensitive objects before
sending them outside a trust boundary
Software Fault Patterns SFP23 Exposed Data
ISA/IEC 62443 Part 3-3 Req SR 4.1
ISA/IEC 62443 Part 4-2 Req CR 4.1B
Related Attack Patterns
CAPEC-ID Attack Pattern Name
65 Sniff Application Code
102 Session Sidejacking
CWE Version 4.14
CWE-321: Use of Hard-coded Cryptographic Key
CWE-321: Use of Hard-coded Cryptographic Key