CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.
Last updated
Overview
While the interpretation of "large number of data accesses/queries" may vary for each product or developer, CISQ recommends a default maximum of 2 data accesses per function/method.
Common consequences
What can happen when CWE-1073 is exploited.
Reduce Performance
Affects: Other
This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
Technologies
Terminology & mappings
Mapped taxonomies
- OMG ASCPEM (ASCPEM-PRF-10)
Frequently asked questions
Common questions about CWE-1073.
- What is CWE-1073?
- The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.
- What are the consequences of CWE-1073?
- Exploiting CWE-1073 can lead to: Reduce Performance.
References
- MITRE CWE definition (CWE-1073) (opens in a new tab)
- CWE-1073 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-1073
Get alerted the moment a new CWE-1073 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.