If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling."
View on MITREFor example, an improper dangling cursor could arise from unhandled exceptions. The impact of the issue depends on the cursor's role, but SQL injection attacks are commonly possible.
Close cursors immediately after access to them is complete. Ensure that you close cursors if exceptions occur.
No detection method information available for this CWE.
No examples or observed CVEs available for this CWE.
CWE-619: Dangling Database Cursor ('Cursor Injection') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling." For example, an improper dangling cursor could arise from unhandled exceptions. The impact of the issue depends on the cursor's role, but SQL injection attacks are commonly possible.
If exploited, CWE-619 (Dangling Database Cursor ('Cursor Injection')) it can compromise Confidentiality and Integrity, leading to outcomes such as Read Application Data and Modify Application Data.
Recommended mitigations for CWE-619 include: Close cursors immediately after access to them is complete. Ensure that you close cursors if exceptions occur.
CWE-619 commonly affects SQL. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-619 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.