The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
Threat Mapped score: 1.8
Industry: Finiancial
Threat priority: P4 - Informational (Low)
CVE: CVE-2022-2054
Python compiler uses eval() to execute malicious strings as Python code.
CVE: CVE-2018-1000613
Cryptography API uses unsafe reflection when deserializing a private key
CVE: CVE-2015-8103
Deserialization issue in commonly-used Java library allows remote execution.
CVE: CVE-2006-7079
Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)
CVE: CVE-2012-2055
Source version control product allows modification of trusted key using mass assignment.
N/A
N/A
| Phase | Note |
|---|---|
| Architecture and Design | N/A |
| Implementation | N/A |
N/A