Detail Tampilan CWE-1008

CWE-1008

Architectural Concepts
2017-06-22 +00:00
Obsolete
Graph
2026-10-28 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Architectural Concepts

This view organizes weaknesses according to common architectural security tactics, as proposed in 2017 as part of an academic "Common Architectural Weakness Enumeration (CAWE)" project. The view was intended to assist architects in identifying potential mistakes that can be made when designing software.

Anggota CWE

CWE-1010: Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CWE-258: Empty Password in Configuration File Dasar
CWE-259: Use of Hard-coded Password Dasar
CWE-262: Not Using Password Aging Dasar
CWE-263: Password Aging with Long Expiration Dasar
CWE-287: Improper Authentication Dasar
CWE-288: Authentication Bypass Using an Alternate Path or Channel Dasar
CWE-289: Authentication Bypass by Alternate Name Dasar
CWE-290: Authentication Bypass by Spoofing Dasar
CWE-291: Reliance on IP Address for Authentication Dasar
CWE-293: Using Referer Field for Authentication Dasar
CWE-294: Authentication Bypass by Capture-replay Dasar
CWE-301: Reflection Attack in an Authentication Protocol Dasar
CWE-302: Authentication Bypass by Assumed-Immutable Data Dasar
CWE-303: Incorrect Implementation of Authentication Algorithm Dasar
CWE-304: Missing Critical Step in Authentication Dasar
CWE-305: Authentication Bypass by Primary Weakness Dasar
CWE-306: Missing Authentication for Critical Functionality Dasar
CWE-307: Improper Restriction of Excessive Authentication Attempts Dasar
CWE-308: Use of Single-factor Authentication Dasar
CWE-322: Key Exchange without Entity Authentication Dasar
CWE-521: Weak Password Requirements Dasar
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created Dasar
CWE-603: Use of Client-Side Authentication Dasar
CWE-620: Unverified Password Change Dasar
CWE-640: Weak Password Recovery Mechanism for Forgotten Password Dasar
CWE-798: Use of Hard-coded Credentials Dasar
CWE-836: Use of Password Hash Instead of Password for Authentication Dasar
CWE-916: Use of Password Hash With Insufficient Computational Effort Dasar
CWE-1011: Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
CWE-114: Process Control Dasar
CWE-15: External Control of System or Configuration Setting Dasar
CWE-219: Storage of File with Sensitive Data Under Web Root Dasar
CWE-220: Storage of File With Sensitive Data Under FTP Root Dasar
CWE-266: Incorrect Privilege Assignment Dasar
CWE-267: Privilege Defined With Unsafe Actions Dasar
CWE-268: Privilege Chaining Dasar
CWE-269: Improper Privilege Management Dasar
CWE-270: Privilege Context Switching Error Dasar
CWE-271: Privilege Dropping / Lowering Errors Dasar
CWE-272: Least Privilege Violation Dasar
CWE-273: Improper Check for Dropped Privileges Dasar
CWE-274: Improper Handling of Insufficient Privileges Dasar
CWE-276: Incorrect Default Permissions Dasar
CWE-277: Insecure Inherited Permissions Dasar
CWE-279: Incorrect Execution-Assigned Permissions Dasar
CWE-280: Improper Handling of Insufficient Permissions or Privileges Dasar
CWE-281: Improper Preservation of Permissions Dasar
CWE-282: Improper Ownership Management Dasar
CWE-283: Unverified Ownership Dasar
CWE-284: Improper Access Control Dasar
CWE-285: Improper Authorization Dasar
CWE-286: Incorrect User Management Dasar
CWE-300: Channel Accessible by Non-Endpoint Dasar
CWE-341: Predictable from Observable State Dasar
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Dasar
CWE-403: Exposure of File Descriptor to Unintended Control Sphere Dasar
CWE-419: Unprotected Primary Channel Dasar
CWE-420: Unprotected Alternate Channel Dasar
CWE-425: Direct Request Dasar
CWE-426: Untrusted Search Path Dasar
CWE-434: Unrestricted Upload of File with Dangerous Type Dasar
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere Dasar
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere Dasar
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere Dasar
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere Dasar
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Dasar
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization Dasar
CWE-552: Files or Directories Accessible to External Parties Dasar
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Dasar
CWE-639: Authorization Bypass Through User-Controlled Key Dasar
CWE-642: External Control of Critical State Data Dasar
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions Dasar
CWE-653: Improper Isolation or Compartmentalization Dasar
CWE-656: Reliance on Security Through Obscurity Dasar
CWE-668: Exposure of Resource to Wrong Sphere Dasar
CWE-669: Incorrect Resource Transfer Between Spheres Dasar
CWE-671: Lack of Administrator Control over Security Dasar
CWE-673: External Influence of Sphere Definition Dasar
CWE-708: Incorrect Ownership Assignment Dasar
CWE-732: Incorrect Permission Assignment for Critical Resource Dasar
CWE-770: Allocation of Resources Without Limits or Throttling Dasar
CWE-782: Exposed IOCTL with Insufficient Access Control Dasar
CWE-827: Improper Control of Document Type Definition Dasar
CWE-862: Missing Authorization Dasar
CWE-863: Incorrect Authorization Dasar
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control Dasar
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints Dasar
CWE-939: Improper Authorization in Handler for Custom URL Scheme Dasar
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains Dasar
CWE-1013: Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
CWE-256: Plaintext Storage of a Password Dasar
CWE-257: Storing Passwords in a Recoverable Format Dasar
CWE-260: Password in Configuration File Dasar
CWE-261: Weak Encoding for Password Dasar
CWE-311: Missing Encryption of Sensitive Data Dasar
CWE-312: Cleartext Storage of Sensitive Information Dasar
CWE-313: Cleartext Storage in a File or on Disk Dasar
CWE-314: Cleartext Storage in the Registry Dasar
CWE-315: Cleartext Storage of Sensitive Information in a Cookie Dasar
CWE-316: Cleartext Storage of Sensitive Information in Memory Dasar
CWE-317: Cleartext Storage of Sensitive Information in GUI Dasar
CWE-318: Cleartext Storage of Sensitive Information in Executable Dasar
CWE-319: Cleartext Transmission of Sensitive Information Dasar
CWE-321: Use of Hard-coded Cryptographic Key Dasar
CWE-323: Reusing a Nonce, Key Pair in Encryption Dasar
CWE-324: Use of a Key Past its Expiration Date Dasar
CWE-325: Missing Cryptographic Step Dasar
CWE-326: Inadequate Encryption Strength Dasar
CWE-327: Use of a Broken or Risky Cryptographic Algorithm Dasar
CWE-328: Use of Weak Hash Dasar
CWE-330: Use of Insufficiently Random Values Dasar
CWE-331: Insufficient Entropy Dasar
CWE-332: Insufficient Entropy in PRNG Dasar
CWE-333: Improper Handling of Insufficient Entropy in TRNG Dasar
CWE-334: Small Space of Random Values Dasar
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Dasar
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Dasar
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Dasar
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Dasar
CWE-339: Small Seed Space in PRNG Dasar
CWE-347: Improper Verification of Cryptographic Signature Dasar
CWE-522: Insufficiently Protected Credentials Dasar
CWE-523: Unprotected Transport of Credentials Dasar
CWE-757: Selection of Less-Secure Algorithm During Negotiation Dasar
CWE-759: Use of a One-Way Hash without a Salt Dasar
CWE-760: Use of a One-Way Hash with a Predictable Salt Dasar
CWE-780: Use of RSA Algorithm without OAEP Dasar
CWE-922: Insecure Storage of Sensitive Information Dasar
CWE-1019: Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
CWE-138: Improper Neutralization of Special Elements Dasar
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Dasar
CWE-20: Improper Input Validation Dasar
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data Dasar
CWE-352: Cross-Site Request Forgery Dasar
CWE-472: External Control of Assumed-Immutable Web Parameter Dasar
CWE-473: PHP External Variable Modification Dasar
CWE-502: Deserialization of Untrusted Data Dasar
CWE-59: Improper Link Resolution Before File Access Dasar
CWE-601: URL Redirection to Untrusted Site Dasar
CWE-641: Improper Restriction of Names for Files and Other Resources Dasar
CWE-643: Improper Neutralization of Data within XPath Expressions Dasar
CWE-652: Improper Neutralization of Data within XQuery Expressions Dasar
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Dasar
CWE-75: Failure to Sanitize Special Elements into a Different Plane Dasar
CWE-76: Improper Neutralization of Equivalent Special Elements Dasar
CWE-77: Improper Neutralization of Special Elements used in a Command Dasar
CWE-78: Improper Neutralization of Special Elements used in an OS Command Dasar
CWE-79: Improper Neutralization of Input During Web Page Generation Dasar
CWE-790: Improper Filtering of Special Elements Dasar
CWE-791: Incomplete Filtering of Special Elements Dasar
CWE-792: Incomplete Filtering of One or More Instances of Special Elements Dasar
CWE-793: Only Filtering One Instance of a Special Element Dasar
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements Dasar
CWE-795: Only Filtering Special Elements at a Specified Location Dasar
CWE-796: Only Filtering Special Elements Relative to a Marker Dasar
CWE-797: Only Filtering Special Elements at an Absolute Position Dasar
CWE-88: Improper Neutralization of Argument Delimiters in a Command Dasar
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Dasar
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Dasar
CWE-91: XML Injection Dasar
CWE-93: Improper Neutralization of CRLF Sequences Dasar
CWE-94: Improper Control of Generation of Code Dasar
CWE-943: Improper Neutralization of Special Elements in Data Query Logic Dasar
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Dasar
CWE-96: Improper Neutralization of Directives in Statically Saved Code Dasar
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Dasar
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Dasar
CWE-99: Improper Control of Resource Identifiers Dasar

Informasi Tampilan CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Komentar : Use this View or other Views to search and navigate for the appropriate weakness.

Catatan


This view was originally created in 2017, but the CAWE project ended, and this view was not actively maintained afterward.

Audiens

Pemangku kepentingan Deskripsi
Software Developers Architects that are part of a software development team may find this view useful as the weaknesses are organized by known security tactics, aiding the architect in embedding security throughout the design process instead of discovering weaknesses after the software has been built.
Educators Educators may use this view as reference material when discussing security by design or architectural weaknesses, and the types of mistakes that can be made.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
Joanna C.S. Santos, Mehdi Mirakhorli 2017-06-22 +00:00 2017-11-08 +00:00 2.12

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2018-03-27 +00:00 updated Description, Other_Notes, View_Audience
CWE Content Team MITRE 2020-02-24 +00:00 updated Maintenance_Notes, View_Audience
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2026-10-28 +00:00 updated Description, References, View_Audience

Referensi

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.