- What is CWE-459?
- The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
- What CVEs are caused by CWE-459?
- 76 recorded CVEs are attributed to CWE-459, including CVE-2023-36468, CVE-2022-45347, CVE-2021-36205.
- Is CWE-459 part of the OWASP Top 10?
- CWE-459 maps to OWASP Top Ten 2004: Insecure Configuration Management (A10) in the OWASP security taxonomy.
- How do you prevent CWE-459?
- Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
- How is CWE-459 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-459?
- Exploiting CWE-459 can lead to: Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other).
- Is CWE-459 actively exploited?
- 76 recorded CVEs are caused by CWE-459; none are currently in CISA's KEV catalog of actively exploited flaws.
