CWE-242
AllowedUse of Inherently Dangerous Function
Abstraction: Base · Status: Draft
The product calls a function that can never be guaranteed to work safely.
21 vulnerabilities reference this CWE, most recent first.
GHSA-M868-6R8G-X6R5
Vulnerability from github – Published: 2025-06-17 21:32 – Updated: 2025-06-17 21:32A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2025-49215"
],
"database_specific": {
"cwe_ids": [
"CWE-242",
"CWE-89"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-17T21:15:39Z",
"severity": "HIGH"
},
"details": "A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. \n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.",
"id": "GHSA-m868-6r8g-x6r5",
"modified": "2025-06-17T21:32:31Z",
"published": "2025-06-17T21:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49215"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/en-US/solution/KA-0019928"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-372"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-58
Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-1009] [REF-7]
Mitigation
Use grep or static analysis tools to spot usage of dangerous functions.
No CAPEC attack patterns related to this CWE.