CWEweakness

CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.

Common consequences

• Availability: DoS: Instability, DoS: Crash, Exit, or Restart, Reduce Reliability, Unexpected State — Warning signals that are not properly secured may be disabled or used to generate spurious alerts, causing degraded performance or denial-of-service (DoS). These alerts may be masked by untrusted software. Examples of these alerts involve thermal and power sensor alerts.

Potential mitigations

• [Architecture and Design] Alert signals generated by critical events should be protected from access by untrusted agents. Only hardware or trusted firmware modules should be able to alter the alert configuration.

Related

Attack pattern · CAPEC (2)

  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs attack pattern
  • CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels attack pattern

Child of · CWE (1)

  • CWE-284 Improper Access Control weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs attack pattern
  • CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels attack pattern

Referenced by CVE · weakness (6)

  • CVE-2023-5635 Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. vulnerability
  • CVE-2023-5443 Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. vulnerability
  • CVE-2023-5570 Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. vulnerability
  • CVE-2023-1014 Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Virames Vira-Investing allows Account Footprinting. vulnerability
  • CVE-2023-0839 Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. vulnerability
  • CVE-2022-2319 A flaw was found in the Xorg-x11-server. vulnerability

Referenced by CWE · has member (1)

  • CWE-1460 Weaknesses Addressed by the Top 20 Secure PLC Coding Practices view