2431
Nature Type ID Name Page
HasMember 610 Externally Controlled Reference to a Resource in
Another Sphere
1008 1364
HasMember 611 Improper Restriction of XML External Entity Reference 1008 1367
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1016: Limit Exposure
Category ID : 1016
Summary
Weaknesses in this category are related to the design and architecture of the entry points to a
system. Frequently these deal with minimizing the attack surface through designing the system
with the least needed amount of entry points. The weaknesses in this category could lead to a
degradation of a system's defenses if they are not addressed when designing or implementing a
secure architecture.
Membership
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 210 Self-generated Error Message Containing Sensitive
Information
1008 539
HasMember 211 Externally-Generated Error Message Containing
Sensitive Information
1008 541
HasMember 214 Invocation of Process Using Visible Sensitive
Information
1008 549
HasMember 550 Server-generated Error Message Containing Sensitive
Information
1008 1263
HasMember 829 Inclusion of Functionality from Untrusted Control Sphere 1008 1741
HasMember 830 Inclusion of Web Functionality from an Untrusted
Source
1008 1747
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1017: Lock Computer
CWE Version 4.14
CWE-1018: Manage User Sessions
CWE-1018: Manage User Sessions