CWE-455—Non-exit on Failed Initialization

名称

Non-exit on Failed Initialization

描述

The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.

常见后果

范围：

Integrity, Other

影响：

Modify Application Data, Alter Execution Logic

注释：

The application could be placed in an insecure state that may allow an attacker to modify sensitive data or allow unintended logic to be executed.

相关 CWE

• CWE-636Not Failing Securely ('Failing Open')
• CWE-665Improper InitializationMedium
• CWE-705Incorrect Control Flow Scoping