CWE-386Symbolic Name not Mapping to Correct Object

PUBLISHEDweakness record
released 2006-07-19 · last modified 2025-12-11

Metadata

CWE ID:
CWE-386
摘要:
Base
结构:
Simple
状态:
Draft
发布日期:
2006-07-19
更新日期:
2025-12-11

名称

Symbolic Name not Mapping to Correct Object

描述

A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.

常见后果

范围:
Access Control
影响:
Gain Privileges or Assume Identity
注释:
The attacker can gain access to otherwise unauthorized resources.
范围:
Integrity, Confidentiality, Other
影响:
Modify Application Data, Modify Files or Directories, Read Application Data, Read Files or Directories, Other
注释:
Race conditions such as this kind may be employed to gain read or write access to resources not normally readable or writable by the user in question.
范围:
Integrity, Other
影响:
Modify Application Data, Other
注释:
The resource in question, or other resources (through the corrupted one) may be changed in undesirable ways by a malicious user.
范围:
Non-Repudiation
影响:
Hide Activities
注释:
If a file or other resource is written in this method, as opposed to a valid way, logging of the activity may not occur.
范围:
Non-Repudiation, Integrity
影响:
Modify Files or Directories
注释:
In some cases it may be possible to delete files that a malicious user might not otherwise have access to -- such as log files.

相关 CWE