7PK - Security Features
A category in the Common Weakness Enumeration published by The MITRE Corporation.
Summary
Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Weaknesses
Using an empty string as a password is insecure.
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the...
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
Storing a password in plaintext may result in a system compromise.
The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to exter...
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Obscuring a password with a trivial encoding does not protect the password.
Concepts
This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.
See Also
- Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
NIST Workshop on Software Security Assurance Tools Techniques and Metrics
Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.