236
ParentOf 827 Improper Control of Document Type Definition 1736
ParentOf 830 Inclusion of Web Functionality from an Untrusted Source 1747
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 669 Incorrect Resource Transfer Between Spheres 1471
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1016 Limit Exposure 2431
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1214 Data Integrity Issues 2477
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the
program by causing the program to download code that the
attacker has placed into the untrusted control sphere, such
as a malicious web site.
Detection Methods
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
CWE Version 4.14
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CWE-829: Inclusion of Functionality from Untrusted Control Sphere