CWE-573: Improper Following of Specification by Caller
Description
The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
When leveraging external functionality, such as an API, it is important that the caller does so in accordance with the requirements of the external functionality or else unintended behaviors may result, possibly leaving the system vulnerable to any number of exploits.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Other
Quality Degradation; Varies by Context
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-103Struts: Incomplete validate() Method Definition
- CWE-104Struts: Form Bean Does Not Extend Validation Class
- CWE-243Creation of chroot Jail Without Changing Working Directory
- CWE-253Incorrect Check of Function Return Value
- CWE-296Improper Following of a Certificate's Chain of Trust
- CWE-304Missing Critical Step in Authentication
- CWE-325Missing Cryptographic Step
- CWE-329Generation of Predictable IV with CBC Mode
- CWE-358Improperly Implemented Security Check for Standard
- CWE-475Undefined Behavior for Input to API
- CWE-568finalize() Method Without super.finalize()
- CWE-577EJB Bad Practices: Use of Sockets
- CWE-578EJB Bad Practices: Use of Class Loader
- CWE-579J2EE Bad Practices: Non-serializable Object Stored in Session
- CWE-580clone() Method Without super.clone()
- CWE-581Object Model Violation: Just One of Equals and Hashcode Defined
- CWE-628Function Call with Incorrectly Specified Arguments
- CWE-675Multiple Operations on Resource in Single-Operation Context
- CWE-694Use of Multiple Resources with Duplicate Identifier
- CWE-695Use of Low-Level Functionality
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.