CWE-914
Improper Control of Dynamically-Identified Variables
2013-02-21
00h00 +00:00
00h00 +00:00
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Nama: Improper Control of Dynamically-Identified Variables
The product does not properly restrict reading from or writing to dynamically-identified variables.
Informasi Umum
Detail Latar Belakang
Mode Pengenalan
Implementation : The dynamic identification of variables can be a powerful, time-saving technique for developers. This practice can reduce maintenance costs because new code would not need to be written for each variable that is managed.Platform yang Berlaku
Bahasa
Kelas: Not Language-Specific (Undetermined)Kelas: Interpreted (Undetermined)
Konsekuensi Umum
| Cakupan | Dampak | Kemungkinan |
|---|---|---|
| Integrity | Modify Application Data Catatan: An attacker could modify sensitive data or critical program variables. | |
| Integrity | Execute Unauthorized Code or Commands | |
| Other Integrity | Varies by Context, Alter Execution Logic |
Contoh yang Diamati
| Referensi | Deskripsi |
|---|---|
CVE-2006-7135 | extract issue enables file inclusion |
CVE-2006-7079 | Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22) |
CVE-2007-0649 | extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect. |
CVE-2006-6661 | extract() enables static code injection |
CVE-2006-2828 | import_request_variables() buried in include files makes post-disclosure analysis confusing |
CVE-2009-0422 | Chain: Dynamic variable evaluation allows resultant remote file inclusion and path traversal. |
CVE-2007-2431 | Chain: dynamic variable evaluation in PHP program used to modify critical, unexpected $_SERVER variable for resultant XSS. |
CVE-2006-4904 | Chain: dynamic variable evaluation in PHP program used to conduct remote file inclusion. |
CVE-2006-4019 | Dynamic variable evaluation in mail program allows reading and modifying attachments and preferences of other users. |
Mitigasi yang Memungkinkan
Phases : ImplementationFor any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
Phases : Implementation // Architecture and Design
Refactor the code so that internal program variables do not need to be dynamically identified.
Catatan Pemetaan Kerentanan
Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Pengajuan
| Nama | Organisasi | Tanggal | Tanggal rilis | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 2.4 |
Modifikasi
| Nama | Organisasi | Tanggal | Komentar |
|---|---|---|---|
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Background_Details, Common_Consequences, Description, Modes_of_Introduction |
