The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
View on MITRENo mitigation information available for this CWE.
No detection method information available for this CWE.
The following code is an example of an internal hard-coded password in the back-end:
Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this "functionality."
The following code is an example of an internal hard-coded password in the back-end:
Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this "functionality."
This code assumes a particular function will always be found at a particular address. It assigns a pointer to that address and calls the function.
The same function may not always be found at the same memory address. This could lead to a crash, or an attacker may alter the memory at the expected address, leading to arbitrary code execution.
Component for web browser writes an error message to a known location, which can then be referenced by attackers to process HTML/script in a less restrictive context
View DetailsCWE-344: Use of Invariant Value in Dynamically Changing Context is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
If exploited, CWE-344 (Use of Invariant Value in Dynamically Changing Context) it can compromise Other, leading to outcomes such as Varies by Context.
CWE-344 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-344, including CVE-2002-0980. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-344 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.