Incorrect Resource Transfer Between Spheres

Opis

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Skutki

• Confidentiality, Integrity

  Read Application Data; Modify Application Data; Unexpected State

Przykłady podatności

• CVE-2021-22909 Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494).
• CVE-2023-5227 PHP-based FAQ management app does not check the MIME type for uploaded images
• CVE-2005-0406 Some image editors modify a JPEG image, but the original EXIF thumbnail image is left intact within the JPEG. (Also an interaction error).

Słabość nadrzędna

• CWE-664 Improper Control of a Resource Through its Lifetime

Słabości podrzędne

• CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
• CWE-243 Creation of chroot Jail Without Changing Working Directory
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-494 Download of Code Without Integrity Check
• CWE-565 Reliance on Cookies without Validation and Integrity Checking
• CWE-829 Inclusion of Functionality from Untrusted Control Sphere
• CWE-1420 Exposure of Sensitive Information during Transient Execution

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• Operation

Dotyczy

Not Language-Specific