이름: Improper Control of Dynamically-Identified Variables

The product does not properly restrict reading from or writing to dynamically-identified variables.

일반 정보

배경 세부 정보

취약점 도입 방식

Implementation : The dynamic identification of variables can be a powerful, time-saving technique for developers. This practice can reduce maintenance costs because new code would not need to be written for each variable that is managed.

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)
클래스: Interpreted (Undetermined)

일반적인 결과

범위	영향	가능성
Integrity	Modify Application Data 참고: An attacker could modify sensitive data or critical program variables.
Integrity	Execute Unauthorized Code or Commands
Other Integrity	Varies by Context, Alter Execution Logic

관찰된 예시

참고 자료	설명
CVE-2006-7135	extract issue enables file inclusion
CVE-2006-7079	Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)
CVE-2007-0649	extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.
CVE-2006-6661	extract() enables static code injection
CVE-2006-2828	import_request_variables() buried in include files makes post-disclosure analysis confusing
CVE-2009-0422	Chain: Dynamic variable evaluation allows resultant remote file inclusion and path traversal.
CVE-2007-2431	Chain: dynamic variable evaluation in PHP program used to modify critical, unexpected $_SERVER variable for resultant XSS.
CVE-2006-4904	Chain: dynamic variable evaluation in PHP program used to conduct remote file inclusion.
CVE-2006-4019	Dynamic variable evaluation in mail program allows reading and modifying attachments and preferences of other users.

잠재적 완화 방법

Phases : Implementation
For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
Phases : Implementation // Architecture and Design
Refactor the code so that internal program variables do not need to be dynamically identified.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

제출

이름	조직	날짜	출시일	Version
CWE Content Team	MITRE	2013-01-26 +00:00	2013-02-21 +00:00	2.4

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2017-01-19 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2020-06-25 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms
CWE Content Team	MITRE	2026-10-28 +00:00	updated Background_Details, Common_Consequences, Description, Modes_of_Introduction

CWE-914 상세 정보

CWE-914