CWE-913 상세 정보

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

배경 세부 정보

취약점 도입 방식

Architecture and Design
Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)
클래스: Interpreted (Undetermined)

일반적인 결과

관찰된 예시

잠재적 완화 방법

Phases : Implementation
For any externally-influenced input, check the input against an allowlist of acceptable values.
Phases : Implementation // Architecture and Design
Refactor the code so that it does not need to be dynamically managed.

탐지 방법

Fuzzing

Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.
효과성 : High

취약점 매핑 메모

근거 : This CWE entry is a Class and might have Base-level children that would be more appropriate
댓글 : Examine children of this entry to see if there is a better fit

제출

수정 사항