Use of Incorrectly-Resolved Name or Reference

Opis

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Skutki

• Confidentiality, Integrity

  Read Application Data; Modify Application Data

Słabość nadrzędna

• CWE-664 Improper Control of a Resource Through its Lifetime

Pokrewna

• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')

Słabości podrzędne

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-41 Improper Resolution of Path Equivalence
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-66 Improper Handling of File Names that Identify Virtual Resources
• CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
• CWE-178 Improper Handling of Case Sensitivity
• CWE-386 Symbolic Name not Mapping to Correct Object
• CWE-827 Improper Control of Document Type Definition

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific