日本語

CWE-621 詳細

CWE-621

Variable Extraction Error
2007-05-07
00h00 +00:00
Incomplete
2026-10-28
00h00 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Variable Extraction Error

The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid.

一般情報

導入モード

Implementation

適用可能なプラットフォーム

言語

名前： PHP (Undetermined)
クラス： Interpreted (Undetermined)

一般的な結果

スコープ 影響 可能性
IntegrityModify Application Data

注記：An attacker could cause the program to overwrite unintended variables.
IntegrityModify Application Data

注記：When using PHP, calling extract() or import_request_variables() without the proper arguments could allow arbitrary global variables to be overwritten, including superglobals.

観察された例

参考文献 説明

CVE-2006-7135

extract issue enables file inclusion

CVE-2006-7079

Chain: PHP app uses extract for register_globals compatibility layer (CWE-621), enabling path traversal (CWE-22)

CVE-2007-0649

extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.

CVE-2006-6661

extract() enables static code injection

CVE-2006-2828

import_request_variables() buried in include files makes post-disclosure analysis confusing

潜在的な緩和策

Phases : Implementation
Use allowlists of variable names that can be extracted.
Phases : Implementation
Consider refactoring your code to avoid extraction routines altogether.
Phases : Implementation
In PHP, call extract() with options such as EXTR_SKIP and EXTR_PREFIX_ALL; call import_request_variables() with a prefix argument. Note that these capabilities are not present in all PHP versions.

脆弱性マッピングノート

理由 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

ノート

Probably under-reported for PHP. Seems under-studied for other interpreted languages.

登録情報

名前 組織 日付 リリース日 Version
CWE Content Team MITRE 2007-05-07 +00:00 2007-05-07 +00:00 Draft 6

変更履歴

名前 組織 日付 コメント
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Description, Relationships, Observed_Example, Other_Notes, Weakness_Ordinalities
CWE Content Team MITRE 2008-10-14 +00:00 updated Description
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated Common_Consequences, Demonstrative_Examples, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2013-02-21 +00:00 updated Demonstrative_Examples, Relationships
CWE Content Team MITRE 2014-06-23 +00:00 updated Description, Other_Notes
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2022-04-28 +00:00 updated Research_Gaps
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships, Type
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2023-10-26 +00:00 updated Observed_Examples
CWE Content Team MITRE 2026-04-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2026-10-28 +00:00 updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。