CWE-344: Use of Invariant Value in Dynamically Changing Context
The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
View on MITRETechnical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
Mitigation Strategies
No mitigation information available for this CWE.
Detection Methods
No detection method information available for this CWE.
Code Examples & CVEs
Demonstrative Examples
The following code is an example of an internal hard-coded password in the back-end:
Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this "functionality."
The following code is an example of an internal hard-coded password in the back-end:
Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this "functionality."
This code assumes a particular function will always be found at a particular address. It assigns a pointer to that address and calls the function.
The same function may not always be found at the same memory address. This could lead to a crash, or an attacker may alter the memory at the expected address, leading to arbitrary code execution.
Observed CVE Examples (1)
Component for web browser writes an error message to a known location, which can then be referenced by attackers to process HTML/script in a less restrictive context
View DetailsCWE Relationships
Frequently Asked Questions
What is CWE-344: Use of Invariant Value in Dynamically Changing Context?+
CWE-344: Use of Invariant Value in Dynamically Changing Context is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
What are the security consequences of Use of Invariant Value in Dynamically Changing Context?+
If exploited, CWE-344 (Use of Invariant Value in Dynamically Changing Context) it can compromise Other, leading to outcomes such as Varies by Context.
Which programming languages are affected by Use of Invariant Value in Dynamically Changing Context?+
CWE-344 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Use of Invariant Value in Dynamically Changing Context?+
MITRE documents real CVEs mapped to CWE-344, including CVE-2002-0980. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-344 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.