繁體中文

CWE-1008 檢視詳細資料

CWE-1008

Architectural Concepts
2017-06-22 +00:00
Obsolete
Graph
2026-10-28 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Architectural Concepts

This view organizes weaknesses according to common architectural security tactics, as proposed in 2017 as part of an academic "Common Architectural Weakness Enumeration (CAWE)" project. The view was intended to assist architects in identifying potential mistakes that can be made when designing software.

CWE 成員

CWE-1010: Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CWE-258: Empty Password in Configuration File 基礎
CWE-259: Use of Hard-coded Password 基礎
CWE-262: Not Using Password Aging 基礎
CWE-263: Password Aging with Long Expiration 基礎
CWE-287: Improper Authentication 基礎
CWE-288: Authentication Bypass Using an Alternate Path or Channel 基礎
CWE-289: Authentication Bypass by Alternate Name 基礎
CWE-290: Authentication Bypass by Spoofing 基礎
CWE-291: Reliance on IP Address for Authentication 基礎
CWE-293: Using Referer Field for Authentication 基礎
CWE-294: Authentication Bypass by Capture-replay 基礎
CWE-301: Reflection Attack in an Authentication Protocol 基礎
CWE-302: Authentication Bypass by Assumed-Immutable Data 基礎
CWE-303: Incorrect Implementation of Authentication Algorithm 基礎
CWE-304: Missing Critical Step in Authentication 基礎
CWE-305: Authentication Bypass by Primary Weakness 基礎
CWE-306: Missing Authentication for Critical Functionality 基礎
CWE-307: Improper Restriction of Excessive Authentication Attempts 基礎
CWE-308: Use of Single-factor Authentication 基礎
CWE-322: Key Exchange without Entity Authentication 基礎
CWE-521: Weak Password Requirements 基礎
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created 基礎
CWE-603: Use of Client-Side Authentication 基礎
CWE-620: Unverified Password Change 基礎
CWE-640: Weak Password Recovery Mechanism for Forgotten Password 基礎
CWE-798: Use of Hard-coded Credentials 基礎
CWE-836: Use of Password Hash Instead of Password for Authentication 基礎
CWE-916: Use of Password Hash With Insufficient Computational Effort 基礎
CWE-1011: Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
CWE-114: Process Control 基礎
CWE-15: External Control of System or Configuration Setting 基礎
CWE-219: Storage of File with Sensitive Data Under Web Root 基礎
CWE-220: Storage of File With Sensitive Data Under FTP Root 基礎
CWE-266: Incorrect Privilege Assignment 基礎
CWE-267: Privilege Defined With Unsafe Actions 基礎
CWE-268: Privilege Chaining 基礎
CWE-269: Improper Privilege Management 基礎
CWE-270: Privilege Context Switching Error 基礎
CWE-271: Privilege Dropping / Lowering Errors 基礎
CWE-272: Least Privilege Violation 基礎
CWE-273: Improper Check for Dropped Privileges 基礎
CWE-274: Improper Handling of Insufficient Privileges 基礎
CWE-276: Incorrect Default Permissions 基礎
CWE-277: Insecure Inherited Permissions 基礎
CWE-279: Incorrect Execution-Assigned Permissions 基礎
CWE-280: Improper Handling of Insufficient Permissions or Privileges 基礎
CWE-281: Improper Preservation of Permissions 基礎
CWE-282: Improper Ownership Management 基礎
CWE-283: Unverified Ownership 基礎
CWE-284: Improper Access Control 基礎
CWE-285: Improper Authorization 基礎
CWE-286: Incorrect User Management 基礎
CWE-300: Channel Accessible by Non-Endpoint 基礎
CWE-341: Predictable from Observable State 基礎
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 基礎
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基礎
CWE-419: Unprotected Primary Channel 基礎
CWE-420: Unprotected Alternate Channel 基礎
CWE-425: Direct Request 基礎
CWE-426: Untrusted Search Path 基礎
CWE-434: Unrestricted Upload of File with Dangerous Type 基礎
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere 基礎
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 基礎
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere 基礎
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 基礎
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 基礎
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 基礎
CWE-552: Files or Directories Accessible to External Parties 基礎
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 基礎
CWE-639: Authorization Bypass Through User-Controlled Key 基礎
CWE-642: External Control of Critical State Data 基礎
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions 基礎
CWE-653: Improper Isolation or Compartmentalization 基礎
CWE-656: Reliance on Security Through Obscurity 基礎
CWE-668: Exposure of Resource to Wrong Sphere 基礎
CWE-669: Incorrect Resource Transfer Between Spheres 基礎
CWE-671: Lack of Administrator Control over Security 基礎
CWE-673: External Influence of Sphere Definition 基礎
CWE-708: Incorrect Ownership Assignment 基礎
CWE-732: Incorrect Permission Assignment for Critical Resource 基礎
CWE-770: Allocation of Resources Without Limits or Throttling 基礎
CWE-782: Exposed IOCTL with Insufficient Access Control 基礎
CWE-827: Improper Control of Document Type Definition 基礎
CWE-862: Missing Authorization 基礎
CWE-863: Incorrect Authorization 基礎
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control 基礎
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints 基礎
CWE-939: Improper Authorization in Handler for Custom URL Scheme 基礎
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains 基礎
CWE-1013: Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
CWE-256: Plaintext Storage of a Password 基礎
CWE-257: Storing Passwords in a Recoverable Format 基礎
CWE-260: Password in Configuration File 基礎
CWE-261: Weak Encoding for Password 基礎
CWE-311: Missing Encryption of Sensitive Data 基礎
CWE-312: Cleartext Storage of Sensitive Information 基礎
CWE-313: Cleartext Storage in a File or on Disk 基礎
CWE-314: Cleartext Storage in the Registry 基礎
CWE-315: Cleartext Storage of Sensitive Information in a Cookie 基礎
CWE-316: Cleartext Storage of Sensitive Information in Memory 基礎
CWE-317: Cleartext Storage of Sensitive Information in GUI 基礎
CWE-318: Cleartext Storage of Sensitive Information in Executable 基礎
CWE-319: Cleartext Transmission of Sensitive Information 基礎
CWE-321: Use of Hard-coded Cryptographic Key 基礎
CWE-323: Reusing a Nonce, Key Pair in Encryption 基礎
CWE-324: Use of a Key Past its Expiration Date 基礎
CWE-325: Missing Cryptographic Step 基礎
CWE-326: Inadequate Encryption Strength 基礎
CWE-327: Use of a Broken or Risky Cryptographic Algorithm 基礎
CWE-328: Use of Weak Hash 基礎
CWE-330: Use of Insufficiently Random Values 基礎
CWE-331: Insufficient Entropy 基礎
CWE-332: Insufficient Entropy in PRNG 基礎
CWE-333: Improper Handling of Insufficient Entropy in TRNG 基礎
CWE-334: Small Space of Random Values 基礎
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基礎
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 基礎
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 基礎
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基礎
CWE-339: Small Seed Space in PRNG 基礎
CWE-347: Improper Verification of Cryptographic Signature 基礎
CWE-522: Insufficiently Protected Credentials 基礎
CWE-523: Unprotected Transport of Credentials 基礎
CWE-757: Selection of Less-Secure Algorithm During Negotiation 基礎
CWE-759: Use of a One-Way Hash without a Salt 基礎
CWE-760: Use of a One-Way Hash with a Predictable Salt 基礎
CWE-780: Use of RSA Algorithm without OAEP 基礎
CWE-922: Insecure Storage of Sensitive Information 基礎
CWE-1019: Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
CWE-138: Improper Neutralization of Special Elements 基礎
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences 基礎
CWE-20: Improper Input Validation 基礎
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data 基礎
CWE-352: Cross-Site Request Forgery 基礎
CWE-472: External Control of Assumed-Immutable Web Parameter 基礎
CWE-473: PHP External Variable Modification 基礎
CWE-502: Deserialization of Untrusted Data 基礎
CWE-59: Improper Link Resolution Before File Access 基礎
CWE-601: URL Redirection to Untrusted Site 基礎
CWE-641: Improper Restriction of Names for Files and Other Resources 基礎
CWE-643: Improper Neutralization of Data within XPath Expressions 基礎
CWE-652: Improper Neutralization of Data within XQuery Expressions 基礎
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 基礎
CWE-75: Failure to Sanitize Special Elements into a Different Plane 基礎
CWE-76: Improper Neutralization of Equivalent Special Elements 基礎
CWE-77: Improper Neutralization of Special Elements used in a Command 基礎
CWE-78: Improper Neutralization of Special Elements used in an OS Command 基礎
CWE-79: Improper Neutralization of Input During Web Page Generation 基礎
CWE-790: Improper Filtering of Special Elements 基礎
CWE-791: Incomplete Filtering of Special Elements 基礎
CWE-792: Incomplete Filtering of One or More Instances of Special Elements 基礎
CWE-793: Only Filtering One Instance of a Special Element 基礎
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements 基礎
CWE-795: Only Filtering Special Elements at a Specified Location 基礎
CWE-796: Only Filtering Special Elements Relative to a Marker 基礎
CWE-797: Only Filtering Special Elements at an Absolute Position 基礎
CWE-88: Improper Neutralization of Argument Delimiters in a Command 基礎
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基礎
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基礎
CWE-91: XML Injection 基礎
CWE-93: Improper Neutralization of CRLF Sequences 基礎
CWE-94: Improper Control of Generation of Code 基礎
CWE-943: Improper Neutralization of Special Elements in Data Query Logic 基礎
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基礎
CWE-96: Improper Neutralization of Directives in Statically Saved Code 基礎
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 基礎
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 基礎
CWE-99: Improper Control of Resource Identifiers 基礎

CWE 檢視資訊

漏洞對應備注

理由說明 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
備註 : Use this View or other Views to search and navigate for the appropriate weakness.

備注


This view was originally created in 2017, but the CAWE project ended, and this view was not actively maintained afterward.

受眾

相關方 描述
Software Developers Architects that are part of a software development team may find this view useful as the weaknesses are organized by known security tactics, aiding the architect in embedding security throughout the design process instead of discovering weaknesses after the software has been built.
Educators Educators may use this view as reference material when discussing security by design or architectural weaknesses, and the types of mistakes that can be made.

提交

名稱 機構 日期 發布日期 Version
Joanna C.S. Santos, Mehdi Mirakhorli 2017-06-22 +00:00 2017-11-08 +00:00 2.12

修改記錄

名稱 機構 日期 備註
CWE Content Team MITRE 2018-03-27 +00:00 updated Description, Other_Notes, View_Audience
CWE Content Team MITRE 2020-02-24 +00:00 updated Maintenance_Notes, View_Audience
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2026-10-28 +00:00 updated Description, References, View_Audience

參考資料

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。