Chi tiết chế độ xem CWE-1008

CWE-1008

Architectural Concepts
2017-06-22 +00:00
Obsolete
Graph
2026-10-28 +00:00
CWE Mitre.org
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Quản lý thông báo

Tên: Architectural Concepts

This view organizes weaknesses according to common architectural security tactics, as proposed in 2017 as part of an academic "Common Architectural Weakness Enumeration (CAWE)" project. The view was intended to assist architects in identifying potential mistakes that can be made when designing software.

Thành viên CWE

CWE-1010: Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CWE-258: Empty Password in Configuration File Cơ sở
CWE-259: Use of Hard-coded Password Cơ sở
CWE-262: Not Using Password Aging Cơ sở
CWE-263: Password Aging with Long Expiration Cơ sở
CWE-287: Improper Authentication Cơ sở
CWE-288: Authentication Bypass Using an Alternate Path or Channel Cơ sở
CWE-289: Authentication Bypass by Alternate Name Cơ sở
CWE-290: Authentication Bypass by Spoofing Cơ sở
CWE-291: Reliance on IP Address for Authentication Cơ sở
CWE-293: Using Referer Field for Authentication Cơ sở
CWE-294: Authentication Bypass by Capture-replay Cơ sở
CWE-301: Reflection Attack in an Authentication Protocol Cơ sở
CWE-302: Authentication Bypass by Assumed-Immutable Data Cơ sở
CWE-303: Incorrect Implementation of Authentication Algorithm Cơ sở
CWE-304: Missing Critical Step in Authentication Cơ sở
CWE-305: Authentication Bypass by Primary Weakness Cơ sở
CWE-306: Missing Authentication for Critical Functionality Cơ sở
CWE-307: Improper Restriction of Excessive Authentication Attempts Cơ sở
CWE-308: Use of Single-factor Authentication Cơ sở
CWE-322: Key Exchange without Entity Authentication Cơ sở
CWE-521: Weak Password Requirements Cơ sở
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created Cơ sở
CWE-603: Use of Client-Side Authentication Cơ sở
CWE-620: Unverified Password Change Cơ sở
CWE-640: Weak Password Recovery Mechanism for Forgotten Password Cơ sở
CWE-798: Use of Hard-coded Credentials Cơ sở
CWE-836: Use of Password Hash Instead of Password for Authentication Cơ sở
CWE-916: Use of Password Hash With Insufficient Computational Effort Cơ sở
CWE-1011: Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
CWE-114: Process Control Cơ sở
CWE-15: External Control of System or Configuration Setting Cơ sở
CWE-219: Storage of File with Sensitive Data Under Web Root Cơ sở
CWE-220: Storage of File With Sensitive Data Under FTP Root Cơ sở
CWE-266: Incorrect Privilege Assignment Cơ sở
CWE-267: Privilege Defined With Unsafe Actions Cơ sở
CWE-268: Privilege Chaining Cơ sở
CWE-269: Improper Privilege Management Cơ sở
CWE-270: Privilege Context Switching Error Cơ sở
CWE-271: Privilege Dropping / Lowering Errors Cơ sở
CWE-272: Least Privilege Violation Cơ sở
CWE-273: Improper Check for Dropped Privileges Cơ sở
CWE-274: Improper Handling of Insufficient Privileges Cơ sở
CWE-276: Incorrect Default Permissions Cơ sở
CWE-277: Insecure Inherited Permissions Cơ sở
CWE-279: Incorrect Execution-Assigned Permissions Cơ sở
CWE-280: Improper Handling of Insufficient Permissions or Privileges Cơ sở
CWE-281: Improper Preservation of Permissions Cơ sở
CWE-282: Improper Ownership Management Cơ sở
CWE-283: Unverified Ownership Cơ sở
CWE-284: Improper Access Control Cơ sở
CWE-285: Improper Authorization Cơ sở
CWE-286: Incorrect User Management Cơ sở
CWE-300: Channel Accessible by Non-Endpoint Cơ sở
CWE-341: Predictable from Observable State Cơ sở
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Cơ sở
CWE-403: Exposure of File Descriptor to Unintended Control Sphere Cơ sở
CWE-419: Unprotected Primary Channel Cơ sở
CWE-420: Unprotected Alternate Channel Cơ sở
CWE-425: Direct Request Cơ sở
CWE-426: Untrusted Search Path Cơ sở
CWE-434: Unrestricted Upload of File with Dangerous Type Cơ sở
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere Cơ sở
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere Cơ sở
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere Cơ sở
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere Cơ sở
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Cơ sở
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization Cơ sở
CWE-552: Files or Directories Accessible to External Parties Cơ sở
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Cơ sở
CWE-639: Authorization Bypass Through User-Controlled Key Cơ sở
CWE-642: External Control of Critical State Data Cơ sở
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions Cơ sở
CWE-653: Improper Isolation or Compartmentalization Cơ sở
CWE-656: Reliance on Security Through Obscurity Cơ sở
CWE-668: Exposure of Resource to Wrong Sphere Cơ sở
CWE-669: Incorrect Resource Transfer Between Spheres Cơ sở
CWE-671: Lack of Administrator Control over Security Cơ sở
CWE-673: External Influence of Sphere Definition Cơ sở
CWE-708: Incorrect Ownership Assignment Cơ sở
CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở
CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở
CWE-782: Exposed IOCTL with Insufficient Access Control Cơ sở
CWE-827: Improper Control of Document Type Definition Cơ sở
CWE-862: Missing Authorization Cơ sở
CWE-863: Incorrect Authorization Cơ sở
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control Cơ sở
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints Cơ sở
CWE-939: Improper Authorization in Handler for Custom URL Scheme Cơ sở
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains Cơ sở
CWE-1013: Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
CWE-256: Plaintext Storage of a Password Cơ sở
CWE-257: Storing Passwords in a Recoverable Format Cơ sở
CWE-260: Password in Configuration File Cơ sở
CWE-261: Weak Encoding for Password Cơ sở
CWE-311: Missing Encryption of Sensitive Data Cơ sở
CWE-312: Cleartext Storage of Sensitive Information Cơ sở
CWE-313: Cleartext Storage in a File or on Disk Cơ sở
CWE-314: Cleartext Storage in the Registry Cơ sở
CWE-315: Cleartext Storage of Sensitive Information in a Cookie Cơ sở
CWE-316: Cleartext Storage of Sensitive Information in Memory Cơ sở
CWE-317: Cleartext Storage of Sensitive Information in GUI Cơ sở
CWE-318: Cleartext Storage of Sensitive Information in Executable Cơ sở
CWE-319: Cleartext Transmission of Sensitive Information Cơ sở
CWE-321: Use of Hard-coded Cryptographic Key Cơ sở
CWE-323: Reusing a Nonce, Key Pair in Encryption Cơ sở
CWE-324: Use of a Key Past its Expiration Date Cơ sở
CWE-325: Missing Cryptographic Step Cơ sở
CWE-326: Inadequate Encryption Strength Cơ sở
CWE-327: Use of a Broken or Risky Cryptographic Algorithm Cơ sở
CWE-328: Use of Weak Hash Cơ sở
CWE-330: Use of Insufficiently Random Values Cơ sở
CWE-331: Insufficient Entropy Cơ sở
CWE-332: Insufficient Entropy in PRNG Cơ sở
CWE-333: Improper Handling of Insufficient Entropy in TRNG Cơ sở
CWE-334: Small Space of Random Values Cơ sở
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-339: Small Seed Space in PRNG Cơ sở
CWE-347: Improper Verification of Cryptographic Signature Cơ sở
CWE-522: Insufficiently Protected Credentials Cơ sở
CWE-523: Unprotected Transport of Credentials Cơ sở
CWE-757: Selection of Less-Secure Algorithm During Negotiation Cơ sở
CWE-759: Use of a One-Way Hash without a Salt Cơ sở
CWE-760: Use of a One-Way Hash with a Predictable Salt Cơ sở
CWE-780: Use of RSA Algorithm without OAEP Cơ sở
CWE-922: Insecure Storage of Sensitive Information Cơ sở
CWE-1019: Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
CWE-138: Improper Neutralization of Special Elements Cơ sở
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Cơ sở
CWE-20: Improper Input Validation Cơ sở
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data Cơ sở
CWE-352: Cross-Site Request Forgery Cơ sở
CWE-472: External Control of Assumed-Immutable Web Parameter Cơ sở
CWE-473: PHP External Variable Modification Cơ sở
CWE-502: Deserialization of Untrusted Data Cơ sở
CWE-59: Improper Link Resolution Before File Access Cơ sở
CWE-601: URL Redirection to Untrusted Site Cơ sở
CWE-641: Improper Restriction of Names for Files and Other Resources Cơ sở
CWE-643: Improper Neutralization of Data within XPath Expressions Cơ sở
CWE-652: Improper Neutralization of Data within XQuery Expressions Cơ sở
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Cơ sở
CWE-75: Failure to Sanitize Special Elements into a Different Plane Cơ sở
CWE-76: Improper Neutralization of Equivalent Special Elements Cơ sở
CWE-77: Improper Neutralization of Special Elements used in a Command Cơ sở
CWE-78: Improper Neutralization of Special Elements used in an OS Command Cơ sở
CWE-79: Improper Neutralization of Input During Web Page Generation Cơ sở
CWE-790: Improper Filtering of Special Elements Cơ sở
CWE-791: Incomplete Filtering of Special Elements Cơ sở
CWE-792: Incomplete Filtering of One or More Instances of Special Elements Cơ sở
CWE-793: Only Filtering One Instance of a Special Element Cơ sở
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements Cơ sở
CWE-795: Only Filtering Special Elements at a Specified Location Cơ sở
CWE-796: Only Filtering Special Elements Relative to a Marker Cơ sở
CWE-797: Only Filtering Special Elements at an Absolute Position Cơ sở
CWE-88: Improper Neutralization of Argument Delimiters in a Command Cơ sở
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Cơ sở
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Cơ sở
CWE-91: XML Injection Cơ sở
CWE-93: Improper Neutralization of CRLF Sequences Cơ sở
CWE-94: Improper Control of Generation of Code Cơ sở
CWE-943: Improper Neutralization of Special Elements in Data Query Logic Cơ sở
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Cơ sở
CWE-96: Improper Neutralization of Directives in Statically Saved Code Cơ sở
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Cơ sở
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Cơ sở
CWE-99: Improper Control of Resource Identifiers Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú


This view was originally created in 2017, but the CAWE project ended, and this view was not actively maintained afterward.

Đối tượng

Bên liên quan Mô tả
Software Developers Architects that are part of a software development team may find this view useful as the weaknesses are organized by known security tactics, aiding the architect in embedding security throughout the design process instead of discovering weaknesses after the software has been built.
Educators Educators may use this view as reference material when discussing security by design or architectural weaknesses, and the types of mistakes that can be made.

Gửi

Tên Tổ chức Ngày Ngày phát hành Version
Joanna C.S. Santos, Mehdi Mirakhorli 2017-06-22 +00:00 2017-11-08 +00:00 2.12

Sửa đổi

Tên Tổ chức Ngày Bình luận
CWE Content Team MITRE 2018-03-27 +00:00 updated Description, Other_Notes, View_Audience
CWE Content Team MITRE 2020-02-24 +00:00 updated Maintenance_Notes, View_Audience
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2026-10-28 +00:00 updated Description, References, View_Audience

Tài liệu tham khảo

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.