CWE-1101
Reliance on Runtime Component in Generated Code
2019-01-03
00h00 +00:00
00h00 +00:00
Notifiche per un CWE specifico
Rimani informato su qualsiasi modifica relativa a un CWE specifico.
Nome: Reliance on Runtime Component in Generated Code
The product uses automatically-generated code that cannot be
executed without a specific runtime support component.
General Informations
Modes Of Introduction
Architecture and DesignPiattaforme applicabili
Linguaggio
Classe: Not Language-Specific (Undetermined)Conseguenze comuni
| Ambito | Impatto | Probabilità |
|---|---|---|
| Other | Reduce Maintainability Nota: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. |
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)Effectiveness : High
Note sulla mappatura delle vulnerabilità
Giustificazione : This entry is primarily a quality issue with no direct security implications.Commento : Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.
Riferimenti
REF-963
Providing a Framework for Effective Software Quality AssessmentRobert A. Martin, Lawrence H. Shafer.
https://www.researchgate.net/publication/285403022_PROVIDING_A_FRAMEWORK_FOR_EFFECTIVE_SOFTWARE_QUALITY_MEASUREMENT_MAKING_A_SCIENCE_OF_RISK_ASSESSMENT
Invio
| Nome | Organizzazione | Data | Data di rilascio | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 3.2 |
Modifiche
| Nome | Organizzazione | Data | Commento |
|---|---|---|---|
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Detection_Factors |
