日本語

CWE-1008 ビュー詳細

CWE-1008

Architectural Concepts
2017-06-22 +00:00
Obsolete
Graph
2026-10-28 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Architectural Concepts

This view organizes weaknesses according to common architectural security tactics, as proposed in 2017 as part of an academic "Common Architectural Weakness Enumeration (CAWE)" project. The view was intended to assist architects in identifying potential mistakes that can be made when designing software.

CWE メンバー

CWE-1010: Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CWE-258: Empty Password in Configuration File ベース
CWE-259: Use of Hard-coded Password ベース
CWE-262: Not Using Password Aging ベース
CWE-263: Password Aging with Long Expiration ベース
CWE-287: Improper Authentication ベース
CWE-288: Authentication Bypass Using an Alternate Path or Channel ベース
CWE-289: Authentication Bypass by Alternate Name ベース
CWE-290: Authentication Bypass by Spoofing ベース
CWE-291: Reliance on IP Address for Authentication ベース
CWE-293: Using Referer Field for Authentication ベース
CWE-294: Authentication Bypass by Capture-replay ベース
CWE-301: Reflection Attack in an Authentication Protocol ベース
CWE-302: Authentication Bypass by Assumed-Immutable Data ベース
CWE-303: Incorrect Implementation of Authentication Algorithm ベース
CWE-304: Missing Critical Step in Authentication ベース
CWE-305: Authentication Bypass by Primary Weakness ベース
CWE-306: Missing Authentication for Critical Functionality ベース
CWE-307: Improper Restriction of Excessive Authentication Attempts ベース
CWE-308: Use of Single-factor Authentication ベース
CWE-322: Key Exchange without Entity Authentication ベース
CWE-521: Weak Password Requirements ベース
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created ベース
CWE-603: Use of Client-Side Authentication ベース
CWE-620: Unverified Password Change ベース
CWE-640: Weak Password Recovery Mechanism for Forgotten Password ベース
CWE-798: Use of Hard-coded Credentials ベース
CWE-836: Use of Password Hash Instead of Password for Authentication ベース
CWE-916: Use of Password Hash With Insufficient Computational Effort ベース
CWE-1011: Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
CWE-114: Process Control ベース
CWE-15: External Control of System or Configuration Setting ベース
CWE-219: Storage of File with Sensitive Data Under Web Root ベース
CWE-220: Storage of File With Sensitive Data Under FTP Root ベース
CWE-266: Incorrect Privilege Assignment ベース
CWE-267: Privilege Defined With Unsafe Actions ベース
CWE-268: Privilege Chaining ベース
CWE-269: Improper Privilege Management ベース
CWE-270: Privilege Context Switching Error ベース
CWE-271: Privilege Dropping / Lowering Errors ベース
CWE-272: Least Privilege Violation ベース
CWE-273: Improper Check for Dropped Privileges ベース
CWE-274: Improper Handling of Insufficient Privileges ベース
CWE-276: Incorrect Default Permissions ベース
CWE-277: Insecure Inherited Permissions ベース
CWE-279: Incorrect Execution-Assigned Permissions ベース
CWE-280: Improper Handling of Insufficient Permissions or Privileges ベース
CWE-281: Improper Preservation of Permissions ベース
CWE-282: Improper Ownership Management ベース
CWE-283: Unverified Ownership ベース
CWE-284: Improper Access Control ベース
CWE-285: Improper Authorization ベース
CWE-286: Incorrect User Management ベース
CWE-300: Channel Accessible by Non-Endpoint ベース
CWE-341: Predictable from Observable State ベース
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor ベース
CWE-403: Exposure of File Descriptor to Unintended Control Sphere ベース
CWE-419: Unprotected Primary Channel ベース
CWE-420: Unprotected Alternate Channel ベース
CWE-425: Direct Request ベース
CWE-426: Untrusted Search Path ベース
CWE-434: Unrestricted Upload of File with Dangerous Type ベース
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere ベース
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere ベース
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere ベース
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere ベース
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory ベース
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization ベース
CWE-552: Files or Directories Accessible to External Parties ベース
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key ベース
CWE-639: Authorization Bypass Through User-Controlled Key ベース
CWE-642: External Control of Critical State Data ベース
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions ベース
CWE-653: Improper Isolation or Compartmentalization ベース
CWE-656: Reliance on Security Through Obscurity ベース
CWE-668: Exposure of Resource to Wrong Sphere ベース
CWE-669: Incorrect Resource Transfer Between Spheres ベース
CWE-671: Lack of Administrator Control over Security ベース
CWE-673: External Influence of Sphere Definition ベース
CWE-708: Incorrect Ownership Assignment ベース
CWE-732: Incorrect Permission Assignment for Critical Resource ベース
CWE-770: Allocation of Resources Without Limits or Throttling ベース
CWE-782: Exposed IOCTL with Insufficient Access Control ベース
CWE-827: Improper Control of Document Type Definition ベース
CWE-862: Missing Authorization ベース
CWE-863: Incorrect Authorization ベース
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control ベース
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints ベース
CWE-939: Improper Authorization in Handler for Custom URL Scheme ベース
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains ベース
CWE-1013: Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
CWE-256: Plaintext Storage of a Password ベース
CWE-257: Storing Passwords in a Recoverable Format ベース
CWE-260: Password in Configuration File ベース
CWE-261: Weak Encoding for Password ベース
CWE-311: Missing Encryption of Sensitive Data ベース
CWE-312: Cleartext Storage of Sensitive Information ベース
CWE-313: Cleartext Storage in a File or on Disk ベース
CWE-314: Cleartext Storage in the Registry ベース
CWE-315: Cleartext Storage of Sensitive Information in a Cookie ベース
CWE-316: Cleartext Storage of Sensitive Information in Memory ベース
CWE-317: Cleartext Storage of Sensitive Information in GUI ベース
CWE-318: Cleartext Storage of Sensitive Information in Executable ベース
CWE-319: Cleartext Transmission of Sensitive Information ベース
CWE-321: Use of Hard-coded Cryptographic Key ベース
CWE-323: Reusing a Nonce, Key Pair in Encryption ベース
CWE-324: Use of a Key Past its Expiration Date ベース
CWE-325: Missing Cryptographic Step ベース
CWE-326: Inadequate Encryption Strength ベース
CWE-327: Use of a Broken or Risky Cryptographic Algorithm ベース
CWE-328: Use of Weak Hash ベース
CWE-330: Use of Insufficiently Random Values ベース
CWE-331: Insufficient Entropy ベース
CWE-332: Insufficient Entropy in PRNG ベース
CWE-333: Improper Handling of Insufficient Entropy in TRNG ベース
CWE-334: Small Space of Random Values ベース
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) ベース
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) ベース
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) ベース
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) ベース
CWE-339: Small Seed Space in PRNG ベース
CWE-347: Improper Verification of Cryptographic Signature ベース
CWE-522: Insufficiently Protected Credentials ベース
CWE-523: Unprotected Transport of Credentials ベース
CWE-757: Selection of Less-Secure Algorithm During Negotiation ベース
CWE-759: Use of a One-Way Hash without a Salt ベース
CWE-760: Use of a One-Way Hash with a Predictable Salt ベース
CWE-780: Use of RSA Algorithm without OAEP ベース
CWE-922: Insecure Storage of Sensitive Information ベース
CWE-1019: Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
CWE-138: Improper Neutralization of Special Elements ベース
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences ベース
CWE-20: Improper Input Validation ベース
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data ベース
CWE-352: Cross-Site Request Forgery ベース
CWE-472: External Control of Assumed-Immutable Web Parameter ベース
CWE-473: PHP External Variable Modification ベース
CWE-502: Deserialization of Untrusted Data ベース
CWE-59: Improper Link Resolution Before File Access ベース
CWE-601: URL Redirection to Untrusted Site ベース
CWE-641: Improper Restriction of Names for Files and Other Resources ベース
CWE-643: Improper Neutralization of Data within XPath Expressions ベース
CWE-652: Improper Neutralization of Data within XQuery Expressions ベース
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ベース
CWE-75: Failure to Sanitize Special Elements into a Different Plane ベース
CWE-76: Improper Neutralization of Equivalent Special Elements ベース
CWE-77: Improper Neutralization of Special Elements used in a Command ベース
CWE-78: Improper Neutralization of Special Elements used in an OS Command ベース
CWE-79: Improper Neutralization of Input During Web Page Generation ベース
CWE-790: Improper Filtering of Special Elements ベース
CWE-791: Incomplete Filtering of Special Elements ベース
CWE-792: Incomplete Filtering of One or More Instances of Special Elements ベース
CWE-793: Only Filtering One Instance of a Special Element ベース
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements ベース
CWE-795: Only Filtering Special Elements at a Specified Location ベース
CWE-796: Only Filtering Special Elements Relative to a Marker ベース
CWE-797: Only Filtering Special Elements at an Absolute Position ベース
CWE-88: Improper Neutralization of Argument Delimiters in a Command ベース
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ベース
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ベース
CWE-91: XML Injection ベース
CWE-93: Improper Neutralization of CRLF Sequences ベース
CWE-94: Improper Control of Generation of Code ベース
CWE-943: Improper Neutralization of Special Elements in Data Query Logic ベース
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ベース
CWE-96: Improper Neutralization of Directives in Statically Saved Code ベース
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page ベース
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ベース
CWE-99: Improper Control of Resource Identifiers ベース

CWE ビュー情報

脆弱性マッピングノート

理由 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
コメント : Use this View or other Views to search and navigate for the appropriate weakness.

ノート


This view was originally created in 2017, but the CAWE project ended, and this view was not actively maintained afterward.

対象者

ステークホルダー 説明
Software Developers Architects that are part of a software development team may find this view useful as the weaknesses are organized by known security tactics, aiding the architect in embedding security throughout the design process instead of discovering weaknesses after the software has been built.
Educators Educators may use this view as reference material when discussing security by design or architectural weaknesses, and the types of mistakes that can be made.

登録情報

名前 組織 日付 リリース日 Version
Joanna C.S. Santos, Mehdi Mirakhorli 2017-06-22 +00:00 2017-11-08 +00:00 2.12

変更履歴

名前 組織 日付 コメント
CWE Content Team MITRE 2018-03-27 +00:00 updated Description, Other_Notes, View_Audience
CWE Content Team MITRE 2020-02-24 +00:00 updated Maintenance_Notes, View_Audience
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2026-10-28 +00:00 updated Description, References, View_Audience

参考文献

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。