Base weakness
Incomplete
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
While the interpretation of "large number of data accesses/queries" may vary for each product or developer, CISQ recommends a default maximum of 2 data accesses per function/method.
Common consequences
What can happen when CWE-1073 is exploited.
Reduce Performance
Affects: Other
This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Architecture and Design
Applies to
Languages
SQL (Often)
Technologies
Database Server (Often)