CWE-693: Protection Mechanism Failure
Description
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
This weakness covers three distinct situations. A missing protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An insufficient protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an ignored mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.
- Abstraction
- PillarThe most abstract kind of weakness: a theme that groups classes.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access Control
Bypass Protection Mechanism
Related weaknesses
Child weaknesses
- CWE-184Incomplete List of Disallowed Inputs
- CWE-311Missing Encryption of Sensitive Data
- CWE-326Inadequate Encryption Strength
- CWE-327Use of a Broken or Risky Cryptographic Algorithm
- CWE-330Use of Insufficiently Random Values
- CWE-345Insufficient Verification of Data Authenticity
- CWE-357Insufficient UI Warning of Dangerous Operations
- CWE-358Improperly Implemented Security Check for Standard
- CWE-424Improper Protection of Alternate Path
- CWE-602Client-Side Enforcement of Server-Side Security
- CWE-653Improper Isolation or Compartmentalization
- CWE-654Reliance on a Single Factor in a Security Decision
- CWE-655Insufficient Psychological Acceptability
- CWE-656Reliance on Security Through Obscurity
- CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
- CWE-807Reliance on Untrusted Inputs in a Security Decision
- CWE-1039Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
- CWE-1248Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
- CWE-1253Incorrect Selection of Fuse Values
- CWE-1269Product Released in Non-Release Configuration
- CWE-1278Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
- CWE-1291Public Key Re-Use for Signing both Debug and Production Code
- CWE-1318Missing Support for Security Features in On-chip Fabrics or Buses
- CWE-1319Improper Protection against Electromagnetic Fault Injection (EM-FI)
- CWE-1326Missing Immutable Root of Trust in Hardware
- CWE-1338Improper Protections Against Hardware Overheating
CAPEC attack patterns that exploit it
- CAPEC-1Accessing Functionality Not Properly Constrained by ACLs
- CAPEC-17Using Malicious Files
- CAPEC-20Encryption Brute Forcing
- CAPEC-22Exploiting Trust in Client
- CAPEC-36Using Unpublished Interfaces or Functionality
- CAPEC-51Poison Web Service Registry
- CAPEC-57Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
- CAPEC-59Session Credential Falsification through Prediction
- CAPEC-65Sniff Application Code
- CAPEC-74Manipulating State
- CAPEC-87Forceful Browsing
- CAPEC-107Cross Site Tracing
- CAPEC-127Directory Indexing
- CAPEC-237Escaping a Sandbox by Calling Code in Another Language
- CAPEC-477Signature Spoofing by Mixing Signed and Unsigned Content
- CAPEC-480Escaping Virtualization
- CAPEC-668Key Negotiation of Bluetooth Attack (KNOB)