Description
View on MITREExtended Description
Strategy: Input Validation For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
Strategy: Refactoring Refactor the code so that internal program variables do not need to be dynamically identified.
No detection method information available for this CWE.
No examples or observed CVEs available for this CWE.
No relationship information available for this CWE.
CWE-914: CWE-914: Improper Control of Dynamically-Identified Variables is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Description Extended Description
If exploited, CWE-914 (CWE-914: Improper Control of Dynamically-Identified Variables) it can compromise Modify Application Data, Execute Unauthorized Code or Commands, Varies by Context and Alter Execution Logic, leading to outcomes such as Scope: Integrity An attacker could modify sensitive data or program variables., Scope: Integrity, Scope: Other and Integrity.
Recommended mitigations for CWE-914 include: Strategy: Input Validation For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified. Strategy: Refactoring Refactor the code so that internal program variables do not need to be dynamically identified.
CWE-914 commonly affects Languages. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-914 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.