Use of Invariant Value in Dynamically Changing Context

Opis

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Skutki

• Other

  Varies by Context

Przykłady podatności

• CVE-2002-0980 Component for web browser writes an error message to a known location, which can then be referenced by attackers to process HTML/script in a less restrictive context

Słabość nadrzędna

• CWE-330 Use of Insufficiently Random Values

Słabości podrzędne

• CWE-323 Reusing a Nonce, Key Pair in Encryption
• CWE-587 Assignment of a Fixed Address to a Pointer
• CWE-798 Use of Hard-coded Credentials
• CWE-1188 Initialization of a Resource with an Insecure Default

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific

Uwagi

overlaps default configuration.

Źródła

1. FIPS PUB 140-2: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES — Information Technology Laboratory, National Institute of Standards and Technology, 2001