1406
When a developer begins to implement input validation for a web application, often the validation
is performed in each area of the code that uses externally-controlled input. In complex applications
with many inputs, the developer often misses a parameter here or a cookie there. One frequentlyapplied
solution is to centralize all input validation, store these validated inputs in a separate
data structure, and require that all access of those inputs must be through that data structure. An
alternate approach would be to use an external input validation framework such as Struts, which
performs the validation before the inputs are ever processed by the code.
Observed Examples
Reference Description
CVE-2007-0408 Server does not properly validate client certificates when reusing cached
connections.
https://www.cve.org/CVERecord?id=CVE-2007-0408
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 988 SFP Secondary Cluster: Race Condition Window 888 2412
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP20 Race Condition Window
Related Attack Patterns
CAPEC-ID Attack Pattern Name
104 Cross Zone Scripting
References
[REF-196]Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer
Systems". Proceedings of the IEEE 63. 1975 September. < http://web.mit.edu/Saltzer/www/
publications/protection/ >.
[REF-526]Sean Barnum and Michael Gegick. "Complete Mediation". 2005 September 2. < https://
web.archive.org/web/20221006191503/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/complete-mediation >.2023-04-07.
CWE-639: Authorization Bypass Through User-Controlled Key
Weakness ID : 639
Structure : Simple
Abstraction : Base
Description
The system's authorization functionality does not prevent one user from gaining access to another
user's data or record by modifying the key value identifying the data.
Extended Description
Retrieval of a user record occurs in the system based on some key value that is under user control.
The key would typically identify a user-related record stored in the system and would be used to
CWE Version 4.14
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-639: Authorization Bypass Through User-Controlled Key