CWE-914
Improper Control of Dynamically-Identified Variables
2013-02-21
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Improper Control of Dynamically-Identified Variables
The product does not properly restrict reading from or writing to dynamically-identified variables.
Thông tin chung
Chi tiết nền tảng
Các cách xuất hiện
Implementation : The dynamic identification of variables can be a powerful, time-saving technique for developers. This practice can reduce maintenance costs because new code would not need to be written for each variable that is managed.Nền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Lớp: Interpreted (Undetermined)
Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Integrity | Modify Application Data Ghi chú: An attacker could modify sensitive data or critical program variables. | |
| Integrity | Execute Unauthorized Code or Commands | |
| Other Integrity | Varies by Context, Alter Execution Logic |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2006-7135 | extract issue enables file inclusion |
CVE-2006-7079 | Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22) |
CVE-2007-0649 | extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect. |
CVE-2006-6661 | extract() enables static code injection |
CVE-2006-2828 | import_request_variables() buried in include files makes post-disclosure analysis confusing |
CVE-2009-0422 | Chain: Dynamic variable evaluation allows resultant remote file inclusion and path traversal. |
CVE-2007-2431 | Chain: dynamic variable evaluation in PHP program used to modify critical, unexpected $_SERVER variable for resultant XSS. |
CVE-2006-4904 | Chain: dynamic variable evaluation in PHP program used to conduct remote file inclusion. |
CVE-2006-4019 | Dynamic variable evaluation in mail program allows reading and modifying attachments and preferences of other users. |
Các biện pháp giảm thiểu tiềm năng
Phases : ImplementationFor any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
Phases : Implementation // Architecture and Design
Refactor the code so that internal program variables do not need to be dynamically identified.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 2.4 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Background_Details, Common_Consequences, Description, Modes_of_Introduction |
