- What is CWE-99?
- The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
- What CVEs are caused by CWE-99?
- 56 recorded CVEs are attributed to CWE-99, including CVE-2022-1287, CVE-2025-0756, CVE-2024-57971.
- How do you prevent CWE-99?
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- How is CWE-99 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-99?
- Exploiting CWE-99 can lead to: Read Application Data, Modify Application Data, Read Files or Directories, Modify Files or Directories.
- Is CWE-99 actively exploited?
- 56 recorded CVEs are caused by CWE-99; none are currently in CISA's KEV catalog of actively exploited flaws.
