CWE-1008 뷰 상세 정보

CWE-1008

Architectural Concepts
2017-06-22 +00:00
Obsolete
Graph
2026-10-28 +00:00
CWE Mitre.org
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
알림 관리

이름: Architectural Concepts

This view organizes weaknesses according to common architectural security tactics, as proposed in 2017 as part of an academic "Common Architectural Weakness Enumeration (CAWE)" project. The view was intended to assist architects in identifying potential mistakes that can be made when designing software.

CWE 구성원

CWE-1010: Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CWE-258: Empty Password in Configuration File 기본
CWE-259: Use of Hard-coded Password 기본
CWE-262: Not Using Password Aging 기본
CWE-263: Password Aging with Long Expiration 기본
CWE-287: Improper Authentication 기본
CWE-288: Authentication Bypass Using an Alternate Path or Channel 기본
CWE-289: Authentication Bypass by Alternate Name 기본
CWE-290: Authentication Bypass by Spoofing 기본
CWE-291: Reliance on IP Address for Authentication 기본
CWE-293: Using Referer Field for Authentication 기본
CWE-294: Authentication Bypass by Capture-replay 기본
CWE-301: Reflection Attack in an Authentication Protocol 기본
CWE-302: Authentication Bypass by Assumed-Immutable Data 기본
CWE-303: Incorrect Implementation of Authentication Algorithm 기본
CWE-304: Missing Critical Step in Authentication 기본
CWE-305: Authentication Bypass by Primary Weakness 기본
CWE-306: Missing Authentication for Critical Functionality 기본
CWE-307: Improper Restriction of Excessive Authentication Attempts 기본
CWE-308: Use of Single-factor Authentication 기본
CWE-322: Key Exchange without Entity Authentication 기본
CWE-521: Weak Password Requirements 기본
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created 기본
CWE-603: Use of Client-Side Authentication 기본
CWE-620: Unverified Password Change 기본
CWE-640: Weak Password Recovery Mechanism for Forgotten Password 기본
CWE-798: Use of Hard-coded Credentials 기본
CWE-836: Use of Password Hash Instead of Password for Authentication 기본
CWE-916: Use of Password Hash With Insufficient Computational Effort 기본
CWE-1011: Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
CWE-114: Process Control 기본
CWE-15: External Control of System or Configuration Setting 기본
CWE-219: Storage of File with Sensitive Data Under Web Root 기본
CWE-220: Storage of File With Sensitive Data Under FTP Root 기본
CWE-266: Incorrect Privilege Assignment 기본
CWE-267: Privilege Defined With Unsafe Actions 기본
CWE-268: Privilege Chaining 기본
CWE-269: Improper Privilege Management 기본
CWE-270: Privilege Context Switching Error 기본
CWE-271: Privilege Dropping / Lowering Errors 기본
CWE-272: Least Privilege Violation 기본
CWE-273: Improper Check for Dropped Privileges 기본
CWE-274: Improper Handling of Insufficient Privileges 기본
CWE-276: Incorrect Default Permissions 기본
CWE-277: Insecure Inherited Permissions 기본
CWE-279: Incorrect Execution-Assigned Permissions 기본
CWE-280: Improper Handling of Insufficient Permissions or Privileges 기본
CWE-281: Improper Preservation of Permissions 기본
CWE-282: Improper Ownership Management 기본
CWE-283: Unverified Ownership 기본
CWE-284: Improper Access Control 기본
CWE-285: Improper Authorization 기본
CWE-286: Incorrect User Management 기본
CWE-300: Channel Accessible by Non-Endpoint 기본
CWE-341: Predictable from Observable State 기본
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 기본
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 기본
CWE-419: Unprotected Primary Channel 기본
CWE-420: Unprotected Alternate Channel 기본
CWE-425: Direct Request 기본
CWE-426: Untrusted Search Path 기본
CWE-434: Unrestricted Upload of File with Dangerous Type 기본
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere 기본
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 기본
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere 기본
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 기본
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 기본
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 기본
CWE-552: Files or Directories Accessible to External Parties 기본
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 기본
CWE-639: Authorization Bypass Through User-Controlled Key 기본
CWE-642: External Control of Critical State Data 기본
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions 기본
CWE-653: Improper Isolation or Compartmentalization 기본
CWE-656: Reliance on Security Through Obscurity 기본
CWE-668: Exposure of Resource to Wrong Sphere 기본
CWE-669: Incorrect Resource Transfer Between Spheres 기본
CWE-671: Lack of Administrator Control over Security 기본
CWE-673: External Influence of Sphere Definition 기본
CWE-708: Incorrect Ownership Assignment 기본
CWE-732: Incorrect Permission Assignment for Critical Resource 기본
CWE-770: Allocation of Resources Without Limits or Throttling 기본
CWE-782: Exposed IOCTL with Insufficient Access Control 기본
CWE-827: Improper Control of Document Type Definition 기본
CWE-862: Missing Authorization 기본
CWE-863: Incorrect Authorization 기본
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control 기본
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints 기본
CWE-939: Improper Authorization in Handler for Custom URL Scheme 기본
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains 기본
CWE-1013: Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
CWE-256: Plaintext Storage of a Password 기본
CWE-257: Storing Passwords in a Recoverable Format 기본
CWE-260: Password in Configuration File 기본
CWE-261: Weak Encoding for Password 기본
CWE-311: Missing Encryption of Sensitive Data 기본
CWE-312: Cleartext Storage of Sensitive Information 기본
CWE-313: Cleartext Storage in a File or on Disk 기본
CWE-314: Cleartext Storage in the Registry 기본
CWE-315: Cleartext Storage of Sensitive Information in a Cookie 기본
CWE-316: Cleartext Storage of Sensitive Information in Memory 기본
CWE-317: Cleartext Storage of Sensitive Information in GUI 기본
CWE-318: Cleartext Storage of Sensitive Information in Executable 기본
CWE-319: Cleartext Transmission of Sensitive Information 기본
CWE-321: Use of Hard-coded Cryptographic Key 기본
CWE-323: Reusing a Nonce, Key Pair in Encryption 기본
CWE-324: Use of a Key Past its Expiration Date 기본
CWE-325: Missing Cryptographic Step 기본
CWE-326: Inadequate Encryption Strength 기본
CWE-327: Use of a Broken or Risky Cryptographic Algorithm 기본
CWE-328: Use of Weak Hash 기본
CWE-330: Use of Insufficiently Random Values 기본
CWE-331: Insufficient Entropy 기본
CWE-332: Insufficient Entropy in PRNG 기본
CWE-333: Improper Handling of Insufficient Entropy in TRNG 기본
CWE-334: Small Space of Random Values 기본
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 기본
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 기본
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 기본
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 기본
CWE-339: Small Seed Space in PRNG 기본
CWE-347: Improper Verification of Cryptographic Signature 기본
CWE-522: Insufficiently Protected Credentials 기본
CWE-523: Unprotected Transport of Credentials 기본
CWE-757: Selection of Less-Secure Algorithm During Negotiation 기본
CWE-759: Use of a One-Way Hash without a Salt 기본
CWE-760: Use of a One-Way Hash with a Predictable Salt 기본
CWE-780: Use of RSA Algorithm without OAEP 기본
CWE-922: Insecure Storage of Sensitive Information 기본
CWE-1019: Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
CWE-138: Improper Neutralization of Special Elements 기본
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences 기본
CWE-20: Improper Input Validation 기본
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data 기본
CWE-352: Cross-Site Request Forgery 기본
CWE-472: External Control of Assumed-Immutable Web Parameter 기본
CWE-473: PHP External Variable Modification 기본
CWE-502: Deserialization of Untrusted Data 기본
CWE-59: Improper Link Resolution Before File Access 기본
CWE-601: URL Redirection to Untrusted Site 기본
CWE-641: Improper Restriction of Names for Files and Other Resources 기본
CWE-643: Improper Neutralization of Data within XPath Expressions 기본
CWE-652: Improper Neutralization of Data within XQuery Expressions 기본
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 기본
CWE-75: Failure to Sanitize Special Elements into a Different Plane 기본
CWE-76: Improper Neutralization of Equivalent Special Elements 기본
CWE-77: Improper Neutralization of Special Elements used in a Command 기본
CWE-78: Improper Neutralization of Special Elements used in an OS Command 기본
CWE-79: Improper Neutralization of Input During Web Page Generation 기본
CWE-790: Improper Filtering of Special Elements 기본
CWE-791: Incomplete Filtering of Special Elements 기본
CWE-792: Incomplete Filtering of One or More Instances of Special Elements 기본
CWE-793: Only Filtering One Instance of a Special Element 기본
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements 기본
CWE-795: Only Filtering Special Elements at a Specified Location 기본
CWE-796: Only Filtering Special Elements Relative to a Marker 기본
CWE-797: Only Filtering Special Elements at an Absolute Position 기본
CWE-88: Improper Neutralization of Argument Delimiters in a Command 기본
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 기본
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 기본
CWE-91: XML Injection 기본
CWE-93: Improper Neutralization of CRLF Sequences 기본
CWE-94: Improper Control of Generation of Code 기본
CWE-943: Improper Neutralization of Special Elements in Data Query Logic 기본
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 기본
CWE-96: Improper Neutralization of Directives in Statically Saved Code 기본
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 기본
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 기본
CWE-99: Improper Control of Resource Identifiers 기본

CWE 뷰 정보

취약점 매핑 메모

근거 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
댓글 : Use this View or other Views to search and navigate for the appropriate weakness.

메모


This view was originally created in 2017, but the CAWE project ended, and this view was not actively maintained afterward.

대상

이해관계자 설명
Software Developers Architects that are part of a software development team may find this view useful as the weaknesses are organized by known security tactics, aiding the architect in embedding security throughout the design process instead of discovering weaknesses after the software has been built.
Educators Educators may use this view as reference material when discussing security by design or architectural weaknesses, and the types of mistakes that can be made.

제출

이름 조직 날짜 출시일 Version
Joanna C.S. Santos, Mehdi Mirakhorli 2017-06-22 +00:00 2017-11-08 +00:00 2.12

수정 사항

이름 조직 날짜 댓글
CWE Content Team MITRE 2018-03-27 +00:00 updated Description, Other_Notes, View_Audience
CWE Content Team MITRE 2020-02-24 +00:00 updated Maintenance_Notes, View_Audience
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2026-10-28 +00:00 updated Description, References, View_Audience

참고 자료

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

CVE Find에 제시된 정보는 엄선된 여러 참고 소스에서 가져옵니다. CVE 데이터는 MITRE Corporation과 국가 취약점 데이터베이스(NVD)에서 제공됩니다. KEV 카탈로그는 CISA에서 가져오며, EPSS 점수는 FIRST.org에서 제공됩니다. CWE 및 CAPEC 데이터는 MITRE Corporation에서 관리하며, CPE 정보는 NVD에서 제공됩니다.