CWE-1267 Detail

CWE-1267

Policy Uses Obsolete Encoding
2020-02-24
00h00 +00:00
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
Notifiche per un CWE specifico
Rimani informato su qualsiasi modifica relativa a un CWE specifico.
Gestione notifiche

Nome: Policy Uses Obsolete Encoding

The product uses an encoding mechanism that is no longer trusted, i.e., an obsolete encoding, to implement access controls.

General Informations

Background Details

Modes Of Introduction

Architecture and Design
Implementation

Piattaforme applicabili

Linguaggio

Classe: Not Language-Specific (Undetermined)

Sistemi operativi

Classe: Not OS-Specific (Undetermined)

Architetture

Classe: Not Architecture-Specific (Undetermined)

Tecnologie

Classe: Not Technology-Specific (Undetermined)

Conseguenze comuni

Ambito Impatto Probabilità
Confidentiality
Integrity
Availability
Access Control		Modify Memory, Read Memory, Modify Files or Directories, Read Files or Directories, DoS: Resource Consumption (Other), Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Reduce ReliabilityHigh

Potential Mitigations

Phases : Architecture and Design // Implementation

Note sulla mappatura delle vulnerabilità

Giustificazione : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commento : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pattern di attacco correlati

CAPEC ID Nome del pattern di attacco
CAPEC-121 Exploit Non-Production Interfaces
CAPEC-681 Exploitation of Improperly Controlled Hardware Security Identifiers

Riferimenti

REF-1093

Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit In Windows And Linux
Brandon Hill.
https://hothardware.com/news/intel-cpu-bug-kernel-memory-isolation-linux-windows-macos

Invio

Nome Organizzazione Data Data di rilascio Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi Intel Corporation 2020-04-18 +00:00 2020-02-24 +00:00 4.1

Modifiche

Nome Organizzazione Data Commento
CWE Content Team MITRE 2020-08-20 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Description, Modes_of_Introduction, Potential_Mitigations
CWE Content Team MITRE 2021-07-20 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2022-04-28 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2022-10-13 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Demonstrative_Examples, Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Background_Details, Description
Le informazioni presentate su CVE Find provengono da diverse fonti di riferimento attentamente selezionate. I dati CVE sono forniti da MITRE Corporation e dal National Vulnerability Database (NVD). Il catalogo delle vulnerabilità sfruttate conosciute (KEV) proviene dalla Cybersecurity and Infrastructure Security Agency (CISA), mentre i punteggi EPSS provengono da FIRST.org. Inoltre, i dati relativi alle vulnerabilità software (CWE) e ai pattern di attacco comuni (CAPEC) sono mantenuti da MITRE Corporation, e le informazioni sulle configurazioni hardware e software (CPE) sono fornite da NVD.