VariantDraftCWE-688

CWE-688: Function Call With Incorrect Variable or Reference as Argument

Description

The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

Abstraction: VariantA weakness tied to a specific language, technology or resource.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

Other
Quality Degradation

Potential mitigations

Testing
Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the product. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.

Related weaknesses

Parent weaknesses

CWE-628Function Call with Incorrectly Specified Arguments

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Potential mitigations

Testing

Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the product. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.