CWE-694 使用多个具有重复标识的资源

Use of Multiple Resources with Duplicate Identifier

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

扩展描述

If the software assumes that each resource has a unique identifier, the software could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 99 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 99 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 1000

• cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 699

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
Access Control	Bypass Protection Mechanism	If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.
Other	Quality Degradation

可能的缓解方案

Architecture and Design

策略:

Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

分析过的案例

标识	说明	链接

Notes

文章来源于互联网:scap中文网