The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Discouraged | P | 664 | Improper Control of a Resource Through its Lifetime |
| ParentOf | Allowed-with-Review | C | 99 | Improper Control of Resource Identifiers ('Resource Injection') |
| ParentOf | Allowed | B | 178 | Improper Handling of Case Sensitivity |
| ParentOf | Allowed | B | 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| ParentOf | Allowed | B | 386 | Symbolic Name not Mapping to Correct Object |
| ParentOf | Allowed | B | 41 | Improper Resolution of Path Equivalence |
| ParentOf | Allowed | B | 59 | Improper Link Resolution Before File Access ('Link Following') |
| ParentOf | Allowed | B | 66 | Improper Handling of File Names that Identify Virtual Resources |
| ParentOf | Allowed | V | 827 | Improper Control of Document Type Definition |
| ParentOf | Allowed | V | 98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 932 | OWASP Top Ten 2013 Category A4 - Insecure Direct Object References |
| MemberOf | Prohibited | C | 981 | SFP Secondary Cluster: Path Traversal |
| MemberOf | Prohibited | V | 1003 | Weaknesses for Simplified Mapping of Published Vulnerabilities |
| MemberOf | Prohibited | C | 1345 | OWASP Top Ten 2021 Category A01:2021 - Broken Access Control |
| MemberOf | Prohibited | C | 1416 | Comprehensive Categorization: Resource Lifecycle Management |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-318 | Modify Application Data (impact) |
| MemberOf | Prohibited | BS | BOSS-328 | Read Application Data (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1345 | OWASP Top Ten 2021 Category A01:2021 - Broken Access Control |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 981 | SFP Secondary Cluster: Path Traversal |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrity | N/A | Read Application DataModify Application Data | N/A |
N/A
N/A
| Reference | Description |
|---|
| Ordinality | Description |
|---|
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|