简体中文

CWE-1008 视图详情

CWE-1008

Architectural Concepts
2017-06-22 +00:00
Obsolete
Graph
2026-10-28 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: Architectural Concepts

This view organizes weaknesses according to common architectural security tactics, as proposed in 2017 as part of an academic "Common Architectural Weakness Enumeration (CAWE)" project. The view was intended to assist architects in identifying potential mistakes that can be made when designing software.

CWE 成员

CWE-1010: Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CWE-258: Empty Password in Configuration File 基础
CWE-259: Use of Hard-coded Password 基础
CWE-262: Not Using Password Aging 基础
CWE-263: Password Aging with Long Expiration 基础
CWE-287: Improper Authentication 基础
CWE-288: Authentication Bypass Using an Alternate Path or Channel 基础
CWE-289: Authentication Bypass by Alternate Name 基础
CWE-290: Authentication Bypass by Spoofing 基础
CWE-291: Reliance on IP Address for Authentication 基础
CWE-293: Using Referer Field for Authentication 基础
CWE-294: Authentication Bypass by Capture-replay 基础
CWE-301: Reflection Attack in an Authentication Protocol 基础
CWE-302: Authentication Bypass by Assumed-Immutable Data 基础
CWE-303: Incorrect Implementation of Authentication Algorithm 基础
CWE-304: Missing Critical Step in Authentication 基础
CWE-305: Authentication Bypass by Primary Weakness 基础
CWE-306: Missing Authentication for Critical Functionality 基础
CWE-307: Improper Restriction of Excessive Authentication Attempts 基础
CWE-308: Use of Single-factor Authentication 基础
CWE-322: Key Exchange without Entity Authentication 基础
CWE-521: Weak Password Requirements 基础
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created 基础
CWE-603: Use of Client-Side Authentication 基础
CWE-620: Unverified Password Change 基础
CWE-640: Weak Password Recovery Mechanism for Forgotten Password 基础
CWE-798: Use of Hard-coded Credentials 基础
CWE-836: Use of Password Hash Instead of Password for Authentication 基础
CWE-916: Use of Password Hash With Insufficient Computational Effort 基础
CWE-1011: Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
CWE-114: Process Control 基础
CWE-15: External Control of System or Configuration Setting 基础
CWE-219: Storage of File with Sensitive Data Under Web Root 基础
CWE-220: Storage of File With Sensitive Data Under FTP Root 基础
CWE-266: Incorrect Privilege Assignment 基础
CWE-267: Privilege Defined With Unsafe Actions 基础
CWE-268: Privilege Chaining 基础
CWE-269: Improper Privilege Management 基础
CWE-270: Privilege Context Switching Error 基础
CWE-271: Privilege Dropping / Lowering Errors 基础
CWE-272: Least Privilege Violation 基础
CWE-273: Improper Check for Dropped Privileges 基础
CWE-274: Improper Handling of Insufficient Privileges 基础
CWE-276: Incorrect Default Permissions 基础
CWE-277: Insecure Inherited Permissions 基础
CWE-279: Incorrect Execution-Assigned Permissions 基础
CWE-280: Improper Handling of Insufficient Permissions or Privileges 基础
CWE-281: Improper Preservation of Permissions 基础
CWE-282: Improper Ownership Management 基础
CWE-283: Unverified Ownership 基础
CWE-284: Improper Access Control 基础
CWE-285: Improper Authorization 基础
CWE-286: Incorrect User Management 基础
CWE-300: Channel Accessible by Non-Endpoint 基础
CWE-341: Predictable from Observable State 基础
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 基础
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基础
CWE-419: Unprotected Primary Channel 基础
CWE-420: Unprotected Alternate Channel 基础
CWE-425: Direct Request 基础
CWE-426: Untrusted Search Path 基础
CWE-434: Unrestricted Upload of File with Dangerous Type 基础
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere 基础
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 基础
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere 基础
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 基础
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 基础
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 基础
CWE-552: Files or Directories Accessible to External Parties 基础
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 基础
CWE-639: Authorization Bypass Through User-Controlled Key 基础
CWE-642: External Control of Critical State Data 基础
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions 基础
CWE-653: Improper Isolation or Compartmentalization 基础
CWE-656: Reliance on Security Through Obscurity 基础
CWE-668: Exposure of Resource to Wrong Sphere 基础
CWE-669: Incorrect Resource Transfer Between Spheres 基础
CWE-671: Lack of Administrator Control over Security 基础
CWE-673: External Influence of Sphere Definition 基础
CWE-708: Incorrect Ownership Assignment 基础
CWE-732: Incorrect Permission Assignment for Critical Resource 基础
CWE-770: Allocation of Resources Without Limits or Throttling 基础
CWE-782: Exposed IOCTL with Insufficient Access Control 基础
CWE-827: Improper Control of Document Type Definition 基础
CWE-862: Missing Authorization 基础
CWE-863: Incorrect Authorization 基础
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control 基础
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints 基础
CWE-939: Improper Authorization in Handler for Custom URL Scheme 基础
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains 基础
CWE-1013: Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
CWE-256: Plaintext Storage of a Password 基础
CWE-257: Storing Passwords in a Recoverable Format 基础
CWE-260: Password in Configuration File 基础
CWE-261: Weak Encoding for Password 基础
CWE-311: Missing Encryption of Sensitive Data 基础
CWE-312: Cleartext Storage of Sensitive Information 基础
CWE-313: Cleartext Storage in a File or on Disk 基础
CWE-314: Cleartext Storage in the Registry 基础
CWE-315: Cleartext Storage of Sensitive Information in a Cookie 基础
CWE-316: Cleartext Storage of Sensitive Information in Memory 基础
CWE-317: Cleartext Storage of Sensitive Information in GUI 基础
CWE-318: Cleartext Storage of Sensitive Information in Executable 基础
CWE-319: Cleartext Transmission of Sensitive Information 基础
CWE-321: Use of Hard-coded Cryptographic Key 基础
CWE-323: Reusing a Nonce, Key Pair in Encryption 基础
CWE-324: Use of a Key Past its Expiration Date 基础
CWE-325: Missing Cryptographic Step 基础
CWE-326: Inadequate Encryption Strength 基础
CWE-327: Use of a Broken or Risky Cryptographic Algorithm 基础
CWE-328: Use of Weak Hash 基础
CWE-330: Use of Insufficiently Random Values 基础
CWE-331: Insufficient Entropy 基础
CWE-332: Insufficient Entropy in PRNG 基础
CWE-333: Improper Handling of Insufficient Entropy in TRNG 基础
CWE-334: Small Space of Random Values 基础
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基础
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 基础
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 基础
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基础
CWE-339: Small Seed Space in PRNG 基础
CWE-347: Improper Verification of Cryptographic Signature 基础
CWE-522: Insufficiently Protected Credentials 基础
CWE-523: Unprotected Transport of Credentials 基础
CWE-757: Selection of Less-Secure Algorithm During Negotiation 基础
CWE-759: Use of a One-Way Hash without a Salt 基础
CWE-760: Use of a One-Way Hash with a Predictable Salt 基础
CWE-780: Use of RSA Algorithm without OAEP 基础
CWE-922: Insecure Storage of Sensitive Information 基础
CWE-1019: Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
CWE-138: Improper Neutralization of Special Elements 基础
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences 基础
CWE-20: Improper Input Validation 基础
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data 基础
CWE-352: Cross-Site Request Forgery 基础
CWE-472: External Control of Assumed-Immutable Web Parameter 基础
CWE-473: PHP External Variable Modification 基础
CWE-502: Deserialization of Untrusted Data 基础
CWE-59: Improper Link Resolution Before File Access 基础
CWE-601: URL Redirection to Untrusted Site 基础
CWE-641: Improper Restriction of Names for Files and Other Resources 基础
CWE-643: Improper Neutralization of Data within XPath Expressions 基础
CWE-652: Improper Neutralization of Data within XQuery Expressions 基础
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 基础
CWE-75: Failure to Sanitize Special Elements into a Different Plane 基础
CWE-76: Improper Neutralization of Equivalent Special Elements 基础
CWE-77: Improper Neutralization of Special Elements used in a Command 基础
CWE-78: Improper Neutralization of Special Elements used in an OS Command 基础
CWE-79: Improper Neutralization of Input During Web Page Generation 基础
CWE-790: Improper Filtering of Special Elements 基础
CWE-791: Incomplete Filtering of Special Elements 基础
CWE-792: Incomplete Filtering of One or More Instances of Special Elements 基础
CWE-793: Only Filtering One Instance of a Special Element 基础
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements 基础
CWE-795: Only Filtering Special Elements at a Specified Location 基础
CWE-796: Only Filtering Special Elements Relative to a Marker 基础
CWE-797: Only Filtering Special Elements at an Absolute Position 基础
CWE-88: Improper Neutralization of Argument Delimiters in a Command 基础
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基础
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基础
CWE-91: XML Injection 基础
CWE-93: Improper Neutralization of CRLF Sequences 基础
CWE-94: Improper Control of Generation of Code 基础
CWE-943: Improper Neutralization of Special Elements in Data Query Logic 基础
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基础
CWE-96: Improper Neutralization of Directives in Statically Saved Code 基础
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 基础
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 基础
CWE-99: Improper Control of Resource Identifiers 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

备注


This view was originally created in 2017, but the CAWE project ended, and this view was not actively maintained afterward.

目标受众

利益相关方 描述
Software Developers Architects that are part of a software development team may find this view useful as the weaknesses are organized by known security tactics, aiding the architect in embedding security throughout the design process instead of discovering weaknesses after the software has been built.
Educators Educators may use this view as reference material when discussing security by design or architectural weaknesses, and the types of mistakes that can be made.

提交记录

名称 组织 日期 发布日期 Version
Joanna C.S. Santos, Mehdi Mirakhorli 2017-06-22 +00:00 2017-11-08 +00:00 2.12

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2018-03-27 +00:00 updated Description, Other_Notes, View_Audience
CWE Content Team MITRE 2020-02-24 +00:00 updated Maintenance_Notes, View_Audience
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2026-10-28 +00:00 updated Description, References, View_Audience

参考资料

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。