| 名称 |
Functionality Misuse |
|
| 攻击可能性 |
典型严重性 |
| Medium |
Medium |
|
| 摘要 |
An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data. |
| 前置条件 |
The adversary has the capability to interact with the application directly.The target system does not adequately implement safeguards to prevent misuse of authorized actions/processes. |
| 解决方案 | Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functionality that can be manipulated for malicious purposes. When implementing security features, consider how they can be misused and compromised. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-1242 |
Inclusion of Undocumented Features or Chicken Bits |
| CWE-1246 |
Improper Write Handling in Limited-write Non-Volatile Memories |
| CWE-1281 |
Sequence of Processor Instructions Leads to Unexpected Behavior |
|