Initialization of a Resource with an Insecure Default

Opis

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Skutki

• Other

  Varies by Context

  The impact of insecure defaults varies widely depending on the functionality that the product controls.

Przykłady podatności

• CVE-2022-36349 insecure default variable initialization in BIOS firmware for a hardware board allows DoS
• CVE-2022-42467 A generic database browser interface has a default mode that exposes a web server to the network, allowing queries to the database.

Słabość nadrzędna

• CWE-1419 Incorrect Initialization of Resource
• CWE-344 Use of Invariant Value in Dynamically Changing Context
• CWE-665 Improper Initialization

Słabości podrzędne

• CWE-453 Insecure Default Variable Initialization

Kiedy powstaje

• Implementation — Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value. However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.
• System Configuration

Dotyczy

Not Language-Specific

Uwagi

This entry improves organization of concepts under initialization. The typical CWE model is to cover "Missing" and "Incorrect" behaviors. Arguably, this entry could be named as "Incorrect" instead of "Insecure." This might be changed in the near future.

Źródła

1. Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure By Design Software — US Cybersecurity and Infrastructure Security Agency, US National Security Agency, US FBI, Australian Signals Directorate, Canadian Centre for Cyber Security, National Cyber Security Centre, OAS, NISC, CSA Singapore, CERT NZ, Norwegian Cyber Security Centre, Korea Internet & Security Agency, JPCERT/CC, 2023