CWE-694: Use of Multiple Resources with Duplicate Identifier

Code Examples & CVEs

Demonstrative Examples

These two Struts validation forms have the same name.

It is not certain which form will be used by Struts. It is critically important that validation logic be maintained and kept in sync with the rest of the product.

BadXML

<form-validation> 				    					 <formset> 					  					   <form name="ProjectForm"> ... </form> 					   <form name="ProjectForm"> ... </form> 					  					 </formset> 				    				   </form-validation>

Observed CVE Examples (1)

CVE-2013-4787

chain: mobile OS verifies cryptographic signature of file in an archive, but then installs a different file with the same name that is also listed in the archive.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-694 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-694, Use of Multiple Resources with Duplicate Identifier, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Use of Multiple Resources with Duplicate Identifier during Architecture and Design

MITRE associates mitigation with Architecture and Design; recorded impacts include Bypass Protection Mechanism, and Quality Degradation; observed examples include CVE-2013-4787. Use these source-defined anchors to turn CWE-694 into implementation, review, and verification checks for the affected component.

CWE-694: Use of Multiple Resources with Duplicate Identifier — MITRE CWE

Triage CWE-694 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-694, Use of Multiple Resources with Duplicate Identifier, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-694

Apply MITRE's full root-cause mapping guidance when using CWE-694, Use of Multiple Resources with Duplicate Identifier. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-694 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-694, Use of Multiple Resources with Duplicate Identifier. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-694: Use of Multiple Resources with Duplicate Identifier?+

CWE-694: Use of Multiple Resources with Duplicate Identifier is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required. If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.

What are the security consequences of Use of Multiple Resources with Duplicate Identifier?+

If exploited, CWE-694 (Use of Multiple Resources with Duplicate Identifier) it can compromise Access Control and Other, leading to outcomes such as Bypass Protection Mechanism and Quality Degradation.

How do you prevent or mitigate Use of Multiple Resources with Duplicate Identifier?+

Recommended mitigations for CWE-694 include: Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

Which programming languages are affected by Use of Multiple Resources with Duplicate Identifier?+

CWE-694 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Use of Multiple Resources with Duplicate Identifier?+

MITRE documents real CVEs mapped to CWE-694, including CVE-2013-4787. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-694 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-694: Use of Multiple Resources with Duplicate Identifier

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Scope

Impact

Mitigation Strategies

Phase

Description

Detection Methods