COMMON WEAKNESS ENUMERATIONDraft

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Soyutlama

Class

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Risk

Başarılı sömürü neye yol açar?

Read Application DataModify Application Data

Etkilenen güvenlik alanları: Confidentiality, Integrity

An adversary could read or modify data, depending on how the resource is intended to be used.
Gain Privileges or Assume Identity

Etkilenen güvenlik alanları: Access Control

An adversary that can supply a reference to an unintended resource can potentially access a resource that they do not have privileges for, thus bypassing existing access control mechanisms.

Savunma

Nasıl önlenir ve çözülür?

  • Follow secure coding guidelines for input handling and boundary checking.
  • Enforce strict security reviews and automated static analysis (SAST) checks.