Detail CWE-1475

CWE-1475

Incomplete Data/State Propagation
2026-10-28
00h00 +00:00
Incomplete
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Incomplete Data/State Propagation

The product passes control to another component or function, or it performs a state transition, but it does not provide some security-critical data/state that is needed by the receiving component/function.

Informasi Umum

Mode Pengenalan

Implementation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Arsitektur

Kelas: Not Architecture-Specific (Undetermined)

Teknologi

Kelas: Not Technology-Specific (Undetermined)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
OtherUnexpected State, Varies by Context
Access ControlGain Privileges or Assume Identity, Bypass Protection Mechanism

Contoh yang Diamati

Referensi Deskripsi

CVE-2026-58052

 Chain: File archive product for Windows does not preserve Mark-of-the-Web (MOTW) when extracting an archive (CWE-1475) due to incorrect matching (CWE-697) and canonicalization.

CVE-2025-50328

 File archive product for Windows does not propagate the Zone.Identifier alternate data stream to extracted files, allowing a Mark-of-the-Web (MOTW) bypass.

CVE-2026-44394

 Chain: Identity service does not propagate an expiry for a token (CWE-1475), allowing attackers to bypass intended token lifetime restrictions (CWE-863).

Mitigasi yang Memungkinkan

Phases : Implementation

Catatan Pemetaan Kerentanan

Justifikasi : This CWE Entry is a Class and might have lower-level children that would be more appropriate
Komentar : Examine children of this entry to see if there is a better fit

Catatan

This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2026-10-23 +00:00 2026-10-28 +00:00 5.0
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.