Insecure Default Variable Initialization

Opis

The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

Skutki

• Integrity

  Modify Application Data

  An attacker could gain access to and modify sensitive data or system information.

Zapobieganie

• System Configuration

  Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.

Przykłady podatności

• CVE-2022-36349 insecure default variable initialization in BIOS firmware for a hardware board allows DoS

Słabość nadrzędna

• CWE-1188 Initialization of a Resource with an Insecure Default

Kiedy powstaje

• Implementation

Dotyczy

PHP, Not Language-Specific

Uwagi

This overlaps other categories, probably should be split into separate items.