CWE-706: Use of Incorrectly-Resolved Name or Reference
Description
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- ConfidentialityIntegrity
Read Application Data; Modify Application Data
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-41Improper Resolution of Path Equivalence
- CWE-59Improper Link Resolution Before File Access ('Link Following')
- CWE-66Improper Handling of File Names that Identify Virtual Resources
- CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
- CWE-178Improper Handling of Case Sensitivity
- CWE-386Symbolic Name not Mapping to Correct Object
- CWE-827Improper Control of Document Type Definition