이름: Incorrect Initialization of Resource

The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.

일반 정보

취약점 도입 방식

Implementation
Manufacturing
Installation
System Configuration
Operation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

운영 체제

클래스: Not OS-Specific (Undetermined)

아키텍처

클래스: Not Architecture-Specific (Undetermined)

기술

클래스: Not Technology-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Confidentiality	Read Memory, Read Application Data, Unexpected State	Unknown
Authorization Integrity	Gain Privileges or Assume Identity
Other	Varies by Context 참고: The technical impact can vary widely based on how the resource is used in the product, and whether its contents affect security decisions.

관찰된 예시

참고 자료	설명
CVE-2020-27211	Chain: microcontroller system-on-chip uses a register value stored in flash to set product protection state on the memory bus and does not contain protection against fault injection (CWE-1319) which leads to an incorrect initialization of the memory bus (CWE-1419) causing the product to be in an unprotected state.
CVE-2023-25815	Chain: a change in an underlying package causes the gettext function to use implicit initialization with a hard-coded path (CWE-1419) under the user-writable C:\ drive, introducing an untrusted search path element (CWE-427) that enables spoofing of messages.
CVE-2022-43468	WordPress module sets internal variables based on external inputs, allowing false reporting of the number of views
CVE-2022-36349	insecure default variable initialization in BIOS firmware for a hardware board allows DoS
CVE-2015-7763	distributed filesystem only initializes part of the variable-length padding for a packet, allowing attackers to read sensitive information from previously-sent packets in the same memory location

잠재적 완화 방법

Phases : Implementation
Choose the safest-possible initialization for security-related resources.
Phases : Implementation
Ensure that each resource (whether variable, memory buffer, register, etc.) is fully initialized.
Phases : Implementation
Pay close attention to complex conditionals or reset sources that affect initialization, since some paths might not perform the initialization.
Phases : Architecture and Design
Ensure that the design and architecture clearly identify what the initialization should be, and that the initialization does not have security implications.

탐지 방법

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

취약점 매핑 메모

근거 : This CWE entry is a Class and might have Base-level children that would be more appropriate
댓글 : Examine children of this entry to see if there is a better fit

참고 자료

제출

이름	조직	날짜	출시일	Version
CWE Content Team	MITRE	2023-10-11 +00:00	2023-10-26 +00:00	4.13

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2024-07-16 +00:00	updated Demonstrative_Examples, References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Detection_Factors, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Demonstrative_Examples, Description, Modes_of_Introduction

CWE-1419 상세 정보

CWE-1419

이름: Incorrect Initialization of Resource

일반 정보

취약점 도입 방식

적용 가능한 플랫폼

언어

운영 체제

아키텍처

기술

일반적인 결과

관찰된 예시

CVE-2020-27211

CVE-2023-25815

CVE-2022-43468

CVE-2022-36349

CVE-2015-7763

잠재적 완화 방법

탐지 방법

Automated Static Analysis

취약점 매핑 메모

참고 자료

REF-1437

REF-1438

REF-1439

제출

수정 사항