CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes

Description

Common consequences· 3

• Integrity — Modify Application Data
  An attacker could modify sensitive data or program variables.
• Integrity — Execute Unauthorized Code or Commands
• Other / Integrity — Varies by Context, Alter Execution Logic

Potential mitigations· 4

• [Implementation]
• [Architecture and Design, Implementation]If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
• [Implementation]For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
• [Implementation, Architecture and Design]Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.

Compliance frameworks addressing this (incoming)2

(incoming)27

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.