CWE-1302 Details

The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier.

Einführungsmodi

Architecture and Design : Such issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.
Implementation : Such issues could be introduced during implementation and identified later during Testing or System Configuration phases.

Anwendbare Plattformen

Sprache

Class: Not Language-Specific (Undetermined)

Betriebssysteme

Class: Not OS-Specific (Undetermined)

Architekturen

Class: Not Architecture-Specific (Undetermined)

Technologien

Class: Not Technology-Specific (Undetermined)

Häufige Konsequenzen

Mögliche Gegenmaßnahmen

Phases : Architecture and Design
Transaction details must be reviewed for design inconsistency and common weaknesses.
Phases : Implementation
Security identifier definition and programming flow must be tested in pre-silicon and post-silicon testing.

Hinweise zur Schwachstellen-Zuordnung

Begründung : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Kommentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Verwandte Angriffsmuster

Einreichung

Änderungen