Architectural Weaknesses (224)

Tactic Description: Logs user activities in order to identify attackers and modifications to the system.

Architectural Weakness Description Impact Type
CAWE-117 Improper Output Neutralization for Logs The software does not neutralize or incorrectly neutralizes output that is written to logs. REALIZATION
CAWE-223 Omission of Security-relevant Information The application does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe. OMISSION
CAWE-224 Obscured Security-relevant Information by Alternate Name The software records security-relevant information according to an alternate name of the affected entity, instead of the canonical name. REALIZATION
CAWE-532 Information Exposure Through Log Files Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. COMMISSION
CAWE-778 Insufficient Logging When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it. COMMISSION
CAWE-779 Logging of Excessive Data The software logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack. REALIZATION

Tactic Description: Verifies the authenticity of actors (i.e. to check if the entity is indeed who it claims to be).

Architectural Weakness Description Impact Type
CAWE-258 Empty Password in Configuration File Using an empty string as a password is insecure. REALIZATION
CAWE-259 Use of Hard-coded Password The software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. REALIZATION
CAWE-262 Not Using Password Aging If no mechanism is in place for managing password aging, users will have no incentive to update passwords in a timely manner. COMMISSION
CAWE-263 Password Aging with Long Expiration Allowing password aging to occur unchecked can result in the possibility of diminished password integrity. COMMISSION
CAWE-287 Improper Authentication When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. REALIZATION
CAWE-288 Authentication Bypass Using an Alternate Path or Channel A product requires authentication, but the product has an alternate path or channel that does not require authentication. COMMISSION
CAWE-289 Authentication Bypass by Alternate Name The software performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor. COMMISSION
CAWE-290 Authentication Bypass by Spoofing This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks. COMMISSION
CAWE-291 Reliance on IP Address for Authentication The software uses an IP address for authentication. COMMISSION
CAWE-293 Using Referer Field for Authentication The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking. COMMISSION
CAWE-294 Authentication Bypass by Capture-replay A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). COMMISSION
CAWE-301 Reflection Attack in an Authentication Protocol Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user. COMMISSION
CAWE-302 Authentication Bypass by Assumed-Immutable Data The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker. COMMISSION
CAWE-303 Incorrect Implementation of Authentication Algorithm The requirements for the software dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. REALIZATION
CAWE-304 Missing Critical Step in Authentication The software implements an authentication technique, but it skips a step that weakens the technique. REALIZATION
CAWE-305 Authentication Bypass by Primary Weakness The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. REALIZATION
CAWE-306 Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. OMMISSION
CAWE-307 Improper Restriction of Excessive Authentication Attempts The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks. COMMISSION
CAWE-308 Use of Single-factor Authentication The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. COMMISSION
CAWE-322 Key Exchange without Entity Authentication The software performs a key exchange with an actor without verifying the identity of that actor. OMMISSION
CAWE-521 Weak Password Requirements The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts. COMMISSION
CAWE-592 Authentication Bypass Issues The software does not properly perform authentication, allowing it to be bypassed through various methods. REALIZATION
CAWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created The software modifies the SSL context after connection creation has begun. REALIZATION
CAWE-603 Use of Client-Side Authentication A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. COMMISSION
CAWE-620 Unverified Password Change When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. REALIZATION
CAWE-640 Weak Password Recovery Mechanism for Forgotten Password The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. COMMISSION
CAWE-798 Use of Hard-coded Credentials The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. REALIZATION
CAWE-836 Use of Password Hash Instead of Password for Authentication The software records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store. REALIZATION
CAWE-916 Use of Password Hash With Insufficient Computational Effort The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. REALIZATION

Tactic Description: Enforces that agents have the required permissions before performing certain operations, such as modifying data.

Architectural Weakness Description Impact Type
CAWE-15 External Control of System or Configuration Setting One or more system settings or configuration elements can be externally controlled by a user. REALIZATION
CAWE-114 Process Control Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker. REALIZATION
CAWE-219 Sensitive Data Under Web Root The application stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties. COMMISSION
CAWE-220 Sensitive Data Under FTP Root The application stores sensitive data under the FTP document root with insufficient access control, which might make it accessible to untrusted parties. COMMISSION
CAWE-266 Incorrect Privilege Assignment A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. REALIZATION
CAWE-267 Privilege Defined With Unsafe Actions A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity. REALIZATION
CAWE-268 Privilege Chaining Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination. REALIZATION
CAWE-269 Improper Privilege Management The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. REALIZATION
CAWE-270 Privilege Context Switching Error The software does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control. REALIZATION
CAWE-271 Privilege Dropping / Lowering Errors The software does not drop privileges before passing control of a resource to an actor that does not have those privileges. REALIZATION
CAWE-272 Least Privilege Violation The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed. REALIZATION
CAWE-273 Improper Check for Dropped Privileges The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. REALIZATION
CAWE-274 Improper Handling of Insufficient Privileges The software does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses. REALIZATION
CAWE-276 Incorrect Default Permissions The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor. REALIZATION
CAWE-277 Insecure Inherited Permissions A product defines a set of insecure permissions that are inherited by objects that are created by the program. REALIZATION
CAWE-279 Incorrect Execution-Assigned Permissions While it is executing, the software sets the permissions of an object in a way that violates the intended permissions that have been specified by the user. REALIZATION
CAWE-280 Improper Handling of Insufficient Permissions or Privileges The application does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the application in an invalid state. REALIZATION
CAWE-281 Improper Preservation of Permissions The software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended. REALIZATION
CAWE-282 Improper Ownership Management The software assigns the wrong ownership, or does not properly verify the ownership, of an object or resource. REALIZATION
CAWE-283 Unverified Ownership The software does not properly verify that a critical resource is owned by the proper entity. REALIZATION
CAWE-284 Improper Access Control The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. REALIZATION
CAWE-285 Improper Authorization The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. REALIZATION
CAWE-286 Incorrect User Management The software does not properly manage a user within its environment. REALIZATION
CAWE-300 Channel Accessible by Non-Endpoint ('Man-in-the-Middle') The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. REALIZATION
CAWE-341 Predictable from Observable State A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc. REALIZATION
CAWE-359 Exposure of Private Information ('Privacy Violation') The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related. OMMISSION
CAWE-403 Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors. REALIZATION
CAWE-419 Unprotected Primary Channel The software uses a primary channel for administration or restricted functionality, but it does not properly protect the channel. OMMISSION
CAWE-420 Unprotected Alternate Channel The software protects a primary channel, but it does not use the same level of protection for an alternate channel. OMMISSION
CAWE-425 Direct Request ('Forced Browsing') The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. OMMISSION
CAWE-426 Untrusted Search Path The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control. COMMISSION
CAWE-434 Unrestricted Upload of File with Dangerous Type The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. OMMISSION
CAWE-527 Exposure of CVS Repository to an Unauthorized Control Sphere The product stores a CVS repository in a directory or other container that is accessible to actors outside of the intended control sphere. OMMISSION
CAWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere The product generates a core dump file in a directory that is accessible to actors outside of the intended control sphere. OMMISSION
CAWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere. OMMISSION
CAWE-530 Exposure of Backup File to an Unauthorized Control Sphere A backup file is stored in a directory that is accessible to actors outside of the intended control sphere. OMMISSION
CAWE-538 File and Directory Information Exposure The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere. OMMISSION
CAWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection. REALIZATION
CAWE-552 Files or Directories Accessible to External Parties Files or directories are accessible in the environment that should not be. OMMISSION
CAWE-566 Authorization Bypass Through User-Controlled SQL Primary Key The software uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor. COMMISSION
CAWE-639 Authorization Bypass Through User-Controlled Key The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. REALIZATION
CAWE-642 External Control of Critical State Data The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors. OMMISSION
CAWE-647 Use of Non-Canonical URL Paths for Authorization Decisions The software defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization. REALIZATION
CAWE-653 Insufficient Compartmentalization The product does not sufficiently compartmentalize functionality or processes that require different privilege levels, rights, or permissions. COMMISSION
CAWE-656 Reliance on Security Through Obscurity The software uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism. REALIZATION
CAWE-668 Exposure of Resource to Wrong Sphere The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. REALIZATION
CAWE-669 Incorrect Resource Transfer Between Spheres The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. REALIZATION
CAWE-671 Lack of Administrator Control over Security The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator. OMMISSION
CAWE-673 External Influence of Sphere Definition The product does not prevent the definition of control spheres from external actors. REALIZATION
CAWE-708 Incorrect Ownership Assignment The software assigns an owner to a resource, but the owner is outside of the intended control sphere. REALIZATION
CAWE-732 Incorrect Permission Assignment for Critical Resource The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. REALIZATION
CAWE-770 Allocation of Resources Without Limits or Throttling The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy for that actor. OMMISSION
CAWE-782 Exposed IOCTL with Insufficient Access Control The software implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL. REALIZATION
CAWE-827 Improper Control of Document Type Definition The software does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the software to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker. REALIZATION
CAWE-862 Missing Authorization The software does not perform an authorization check when an actor attempts to access a resource or perform an action. OMISSION
CAWE-863 Incorrect Authorization The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. REALIZATION
CAWE-921 Storage of Sensitive Data in a Mechanism without Access Control The software stores sensitive information in a file system or device that does not have built-in access control. OMMISSION
CAWE-923 Improper Restriction of Communication Channel to Intended Endpoints The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. REALIZATION
CAWE-939 Improper Authorization in Handler for Custom URL Scheme The software uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme. REALIZATION
CAWE-942 Overly Permissive Cross-domain Whitelist The software uses a cross-domain policy file that includes domains that should not be trusted. COMMISSION

Tactic Description: These are weaknessess that can impact multiple security tactics.

Architectural Weakness Description Impact Type
CAWE-208 Information Exposure Through Timing Discrepancy Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. COMMISSION
CAWE-392 Missing Report of Error Condition The software encounters an error but does not provide a status code or return value to indicate that an error has occurred. OMMISSION
CAWE-460 Improper Cleanup on Thrown Exception The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow. REALIZATION
CAWE-544 Missing Standardized Error Handling Mechanism The software does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses. OMMISSION
CAWE-602 Client-Side Enforcement of Server-Side Security The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. COMMISSION
CAWE-703 Improper Check or Handling of Exceptional Conditions The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software. REALIZATION
CAWE-754 Improper Check for Unusual or Exceptional Conditions The software does not check or improperly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software. REALIZATION
CAWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user. OMMISSION
CAWE-807 Reliance on Untrusted Inputs in a Security Decision The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. COMMISSION

Tactic Description: Maintains data confidentiality through use of encryption libraries.

Architectural Weakness Description Impact Type
CAWE-256 Plaintext Storage of a Password Storing a password in plaintext may result in a system compromise. OMMISSION
CAWE-257 Storing Passwords in a Recoverable Format The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. COMMISSION
CAWE-260 Password in Configuration File The software stores a password in a configuration file that might be accessible to actors who do not know the password. OMMISSION
CAWE-261 Weak Cryptography for Passwords Obscuring a password with a trivial encoding does not protect the password. COMMISSION
CAWE-311 Missing Encryption of Sensitive Data The software does not encrypt sensitive or critical information before storage or transmission. OMMISSION
CAWE-312 Cleartext Storage of Sensitive Information The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. OMMISSION
CAWE-313 Cleartext Storage in a File or on Disk The application stores sensitive information in cleartext in a file, or on disk. OMMISSION
CAWE-314 Cleartext Storage in the Registry The application stores sensitive information in cleartext in the registry. OMMISSION
CAWE-315 Cleartext Storage of Sensitive Information in a Cookie The application stores sensitive information in cleartext in a cookie. OMMISSION
CAWE-316 Cleartext Storage of Sensitive Information in Memory The application stores sensitive information in cleartext in memory. OMMISSION
CAWE-317 Cleartext Storage of Sensitive Information in GUI The application stores sensitive information in cleartext within the GUI. OMMISSION
CAWE-318 Cleartext Storage of Sensitive Information in Executable The application stores sensitive information in cleartext in an executable. OMMISSION
CAWE-319 Cleartext Transmission of Sensitive Information The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. OMMISSION
CAWE-321 Use of Hard-coded Cryptographic Key The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. REALIZATION
CAWE-323 Reusing a Nonce, Key Pair in Encryption Nonces should be used for the present occasion and only once. REALIZATION
CAWE-324 Use of a Key Past its Expiration Date The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key. REALIZATION
CAWE-325 Missing Required Cryptographic Step The software does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by that algorithm. REALIZATION
CAWE-326 Inadequate Encryption Strength The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. COMMISSION
CAWE-327 Use of a Broken or Risky Cryptographic Algorithm The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information. COMMISSION
CAWE-328 Reversible One-Way Hash The product uses a hashing algorithm that produces a hash value that can be used to determine the original input, or to find an input that can produce the same hash, more efficiently than brute force techniques. COMMISSION
CAWE-330 Use of Insufficiently Random Values The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers. REALIZATION
CAWE-331 Insufficient Entropy The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. REALIZATION
CAWE-332 Insufficient Entropy in PRNG The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat. REALIZATION
CAWE-333 Improper Handling of Insufficient Entropy in TRNG True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block. REALIZATION
CAWE-334 Small Space of Random Values The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks. REALIZATION
CAWE-335 PRNG Seed Error A Pseudo-Random Number Generator (PRNG) uses seeds incorrectly. REALIZATION
CAWE-336 Same Seed in PRNG A PRNG uses the same seed each time the product is initialized. If an attacker can guess (or knows) the seed, then he/she may be able to determine the "random" number produced from the PRNG. REALIZATION
CAWE-337 Predictable Seed in PRNG A PRNG is initialized from a predictable seed, e.g. using process ID or system time. REALIZATION
CAWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG is not cryptographically strong. REALIZATION
CAWE-339 Small Seed Space in PRNG A PRNG uses a relatively small space of seeds. REALIZATION
CAWE-347 Improper Verification of Cryptographic Signature The software does not verify, or incorrectly verifies, the cryptographic signature for data. REALIZATION
CAWE-522 Insufficiently Protected Credentials This weakness occurs when the application transmits or stores authentication credentials and uses an insecure method that is susceptible to unauthorized interception and/or retrieval. COMMISSION
CAWE-523 Unprotected Transport of Credentials Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server. OMMISSION
CAWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. COMMISSION
CAWE-759 Use of a One-Way Hash without a Salt The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. REALIZATION
CAWE-760 Use of a One-Way Hash with a Predictable Salt The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software uses a predictable salt as part of the input. REALIZATION
CAWE-780 Use of RSA Algorithm without OAEP The software uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption. REALIZATION
CAWE-922 Insecure Storage of Sensitive Information The software stores sensitive information without properly limiting read or write access by unauthorized actors. OMMISSION

Tactic Description: Indicated the external agents that provide inputs into the systems.

Architectural Weakness Description Impact Type
CAWE-295 Improper Certificate Validation The software does not validate, or incorrectly validates, a certificate. REALIZATION
CAWE-296 Improper Following of a Certificate's Chain of Trust The software does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate. REALIZATION
CAWE-297 Improper Validation of Certificate with Host Mismatch The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host. REALIZATION
CAWE-298 Improper Validation of Certificate Expiration A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to certificates that have been abandoned due to age. REALIZATION
CAWE-299 Improper Check for Certificate Revocation The software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised. REALIZATION
CAWE-345 Insufficient Verification of Data Authenticity The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. REALIZATION
CAWE-346 Origin Validation Error The software does not properly verify that the source of data or communication is valid. REALIZATION
CAWE-370 Missing Check for Certificate Revocation after Initial Check The software does not check the revocation status of a certificate after its initial revocation check, which can cause the software to perform privileged actions even after the certificate is revoked at a later time. OMMISSION
CAWE-441 Unintended Proxy or Intermediary ('Confused Deputy') The software receives a request, message, or directive from an upstream component, but the software does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the software's control sphere. This causes the software to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. REALIZATION
CAWE-599 Missing Validation of OpenSSL Certificate The software uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements. OMMISSION
CAWE-940 Improper Verification of Source of a Communication Channel The software establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin. REALIZATION
CAWE-941 Incorrectly Specified Destination in a Communication Channel The software creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor. REALIZATION

Tactic Description: Limits the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points

Architectural Weakness Description Impact Type
CAWE-73 External Control of File Name or Path The software allows user input to control or influence paths or file names that are used in filesystem operations. REALIZATION
CAWE-201 Information Exposure Through Sent Data The accidental exposure of sensitive information through sent data refers to the transmission of data which are either sensitive in and of itself or useful in the further exploitation of the system through standard data channels. REALIZATION
CAWE-209 Information Exposure Through an Error Message The software generates an error message that includes sensitive information about its environment, users, or associated data. REALIZATION
CAWE-212 Improper Cross-boundary Removal of Sensitive Data The software uses a resource that contains sensitive data, but it does not properly remove that data before it stores, transfers, or shares the resource with actors in another control sphere. REALIZATION
CAWE-243 Creation of chroot Jail Without Changing Working Directory The program uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail. REALIZATION
CAWE-250 Execution with Unnecessary Privileges The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. REALIZATION
CAWE-610 Externally Controlled Reference to a Resource in Another Sphere The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. COMMISSION
CAWE-611 Improper Restriction of XML External Entity Reference ('XXE') The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. REALIZATION

Tactic Description: Minimizes the attack surface through designing the system with the least needed amount of entry points

Architectural Weakness Description Impact Type
CAWE-210 Information Exposure Through Self-generated Error Message The software identifies an error condition and creates its own diagnostic or error messages that contain sensitive information. REALIZATION
CAWE-211 Information Exposure Through Externally-generated Error Message The software performs an operation that triggers an external diagnostic or error message that is not directly generated by the software, such as an error generated by the programming language interpreter that the software uses. The error can contain sensitive system information. REALIZATION
CAWE-214 Information Exposure Through Process Environment A process is invoked with sensitive arguments, environment variables, or other elements that can be seen by other processes on the operating system. REALIZATION
CAWE-550 Information Exposure Through Server Error Message Certain conditions, such as network failure, will cause a server error message to be displayed. REALIZATION
CAWE-829 Inclusion of Functionality from Untrusted Control Sphere The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. REALIZATION
CAWE-830 Inclusion of Web Functionality from an Untrusted Source The software includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the software, potentially granting total access and control of the software to the untrusted source. REALIZATION

Tactic Description: A lockout mechanism that takes effect in case of multiple failed attempts to access a given resource.

Architectural Weakness Description Impact Type
CAWE-645 Overly Restrictive Account Lockout Mechanism The software contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily. This allows attackers to deny service to legitimate users by causing their accounts to be locked out. COMMISSION

Tactic Description: Retains the information or status about each user and his/her access rights for the duration of multiple requests

Architectural Weakness Description Impact Type
CAWE-6 J2EE Misconfiguration: Insufficient Session-ID Length The J2EE application is configured to use an insufficient session ID length. COMMISSION
CAWE-384 Session Fixation Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. REALIZATION
CAWE-488 Exposure of Data Element to Wrong Session The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session. REALIZATION
CAWE-579 J2EE Bad Practices: Non-serializable Object Stored in Session The application stores a non-serializable object as an HttpSession attribute, which can hurt reliability. REALIZATION
CAWE-613 Insufficient Session Expiration According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." REALIZATION
CAWE-841 Improper Enforcement of Behavioral Workflow The software supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. REALIZATION

Tactic Description: Sanitizes, neutralizes and validates any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data

Architectural Weakness Description Impact Type
CAWE-20 Improper Input Validation The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. REALIZATION
CAWE-59 Improper Link Resolution Before File Access ('Link Following') The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. REALIZATION
CAWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. REALIZATION
CAWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) The software does not adequately filter user-controlled input for special elements with control implications. REALIZATION
CAWE-76 Improper Neutralization of Equivalent Special Elements The software properly neutralizes certain special elements, but it improperly neutralizes equivalent special elements. REALIZATION
CAWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. REALIZATION
CAWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. REALIZATION
CAWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. REALIZATION
CAWE-88 Argument Injection or Modification The software does not sufficiently delimit the arguments being passed to a component in another control sphere, allowing alternate arguments to be provided, leading to potentially security-relevant changes. REALIZATION
CAWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. REALIZATION
CAWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component. REALIZATION
CAWE-91 XML Injection (aka Blind XPath Injection) The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. REALIZATION
CAWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. REALIZATION
CAWE-94 Improper Control of Generation of Code ('Code Injection') The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. REALIZATION
CAWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). REALIZATION
CAWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template. REALIZATION
CAWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page The software generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive. REALIZATION
CAWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. REALIZATION
CAWE-99 Improper Control of Resource Identifiers ('Resource Injection') The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. REALIZATION
CAWE-138 Improper Neutralization of Special Elements The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component. REALIZATION
CAWE-150 Improper Neutralization of Escape, Meta, or Control Sequences The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component. As data is parsed, an injected/absent/malformed delimiter may cause the process to take unexpected actions. REALIZATION
CAWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data The software, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. OMMISSION
CAWE-352 Cross-Site Request Forgery (CSRF) The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution. REALIZATION
CAWE-472 External Control of Assumed-Immutable Web Parameter The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. OMMISSION
CAWE-473 PHP External Variable Modification A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise. REALIZATION
CAWE-502 Deserialization of Untrusted Data The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. OMMISSION
CAWE-601 URL Redirection to Untrusted Site ('Open Redirect') A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. OMMISSION
CAWE-641 Improper Restriction of Names for Files and Other Resources The application constructs the name of a file or other resource using input from an upstream component, but does not restrict or incorrectly restricts the resulting name. REALIZATION
CAWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection') The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query. REALIZATION
CAWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') The software uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query. REALIZATION
CAWE-790 Improper Filtering of Special Elements The software receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component. REALIZATION
CAWE-791 Incomplete Filtering of Special Elements The software receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component. REALIZATION
CAWE-792 Incomplete Filtering of One or More Instances of Special Elements The software receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component. REALIZATION
CAWE-793 Only Filtering One Instance of a Special Element The software receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component. REALIZATION
CAWE-794 Incomplete Filtering of Multiple Instances of Special Elements The software receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component. REALIZATION
CAWE-795 Only Filtering Special Elements at a Specified Location The software receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component. REALIZATION
CAWE-796 Only Filtering Special Elements Relative to a Marker The software receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component. REALIZATION
CAWE-797 Only Filtering Special Elements at an Absolute Position The software receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component. REALIZATION
CAWE-943 Improper Neutralization of Special Elements in Data Query Logic The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. REALIZATION

Tactic Description: Ensures integrity of data, such as messages, resource files, deployment files, and configuration files

Architectural Weakness Description Impact Type
CAWE-353 Missing Support for Integrity Check The software uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum. OMMISSION
CAWE-354 Improper Validation of Integrity Check Value The software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. REALIZATION
CAWE-390 Detection of Error Condition Without Action The software detects a specific error, but takes no actions to handle the error. REALIZATION
CAWE-391 Unchecked Error Condition Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed. REALIZATION
CAWE-494 Download of Code Without Integrity Check The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. OMMISSION
CAWE-565 Reliance on Cookies without Validation and Integrity Checking The application relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user. OMMISSION
CAWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking The software uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the software does not use integrity checks to detect if those inputs have been modified. OMMISSION
CAWE-707 Improper Enforcement of Message or Data Structure The software does not enforce or incorrectly enforces that structured messages or data are well-formed before being read from an upstream component or sent to a downstream component. REALIZATION
CAWE-755 Improper Handling of Exceptional Conditions The software does not handle or incorrectly handles an exceptional condition. REALIZATION
CAWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel The software establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission. REALIZATION