1521
Abstraction : Pillar
Description
The product does not use or incorrectly uses a protection mechanism that provides sufficient
defense against directed attacks against the product.
Extended Description
This weakness covers three distinct situations. A "missing" protection mechanism occurs when
the application does not define any mechanism against a certain class of attack. An "insufficient"
protection mechanism might provide some defenses - for example, against the most common
attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism
occurs when a mechanism is available and in active use within the product, but the developer has
not applied it in some code path.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
MemberOf 1000 Research Concepts 2575
ParentOf 182 Collapse of Data into Unsafe Value 455
ParentOf 184 Incomplete List of Disallowed Inputs 459
ParentOf 311 Missing Encryption of Sensitive Data 757
ParentOf 326 Inadequate Encryption Strength 796
ParentOf 327 Use of a Broken or Risky Cryptographic Algorithm 799
ParentOf 330 Use of Insufficiently Random Values 814
ParentOf 345 Insufficient Verification of Data Authenticity 851
ParentOf 357 Insufficient UI Warning of Dangerous Operations 880
ParentOf 358 Improperly Implemented Security Check for Standard 881
ParentOf 424 Improper Protection of Alternate Path 1023
ParentOf 602 Client-Side Enforcement of Server-Side Security 1350
ParentOf 653 Improper Isolation or Compartmentalization 1437
ParentOf 654 Reliance on a Single Factor in a Security Decision 1439
ParentOf 655 Insufficient Psychological Acceptability 1442
ParentOf 656 Reliance on Security Through Obscurity 1444
ParentOf 757 Selection of Less-Secure Algorithm During Negotiation
('Algorithm Downgrade')