CWE-485
Grouping Prohibited7PK - Encapsulation
Status: Draft
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."
Grouping entries organize the catalogue and should not be used to map the root cause of a vulnerability.
Mapping guidance
This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
See member weaknesses of this category.
Relationships and members
Notes
Other
The "encapsulation" term is used in multiple ways. Within some security sources, the term is used to describe the establishment of boundaries between different control spheres. Within general computing circles, it is more about hiding implementation details and maintainability than security. Even within the security usage, there is also a question of whether "encapsulation" encompasses the entire range of security problems.
Content history
updated Potential_Mitigations, Time_of_Introduction
updated Description, Maintenance_Notes, Relationships, Taxonomy_Mappings, Terminology_Notes
updated Relationships
updated Relationships
updated Common_Consequences
updated Common_Consequences
updated Relationships, Taxonomy_Mappings
updated Relationships
updated Potential_Mitigations, Terminology_Notes
updated Relationships
updated Relationships
updated Relationships
updated Relationships
updated Relationships
updated Common_Consequences, Description, Maintenance_Notes, Name, Other_Notes, References, Relationships, Taxonomy_Mappings, Terminology_Notes, Time_of_Introduction, Type
updated Relationships
updated References
updated Mapping_Notes
updated Mapping_Notes
updated Mapping_Notes, References, Type
1 vulnerability references this CWE, most recent first.
CVE-2017-7911 (GCVE-0-2017-7911)
Vulnerability from cvelistv5 – Published: 2017-05-06 00:00 – Updated: 2024-08-05 16:19| URL | Tags |
|---|---|
| https://www.tenable.com/security/research/tra-2017-19 | x_refsource_MISC |
| http://www.securityfocus.com/bid/98256 | vdb-entryx_refsource_BID |
| https://ics-cert.us-cert.gov/advisories/ICSA-17-122-02 | x_refsource_MISC |
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | CyberVision Kaa IoT Platform |
Affected:
CyberVision Kaa IoT Platform
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:19:28.663Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2017-19"
},
{
"name": "98256",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98256"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-122-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CyberVision Kaa IoT Platform",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "CyberVision Kaa IoT Platform"
}
]
}
],
"datePublic": "2017-05-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A Code Injection issue was discovered in CyberVision Kaa IoT Platform, Version 0.7.4. An insufficient-encapsulation vulnerability has been identified, which may allow remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-485",
"description": "CWE-485",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-02T09:57:01.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2017-19"
},
{
"name": "98256",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98256"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-122-02"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2017-7911",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CyberVision Kaa IoT Platform",
"version": {
"version_data": [
{
"version_value": "CyberVision Kaa IoT Platform"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Code Injection issue was discovered in CyberVision Kaa IoT Platform, Version 0.7.4. An insufficient-encapsulation vulnerability has been identified, which may allow remote code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-485"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tenable.com/security/research/tra-2017-19",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2017-19"
},
{
"name": "98256",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98256"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-122-02",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-122-02"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2017-7911",
"datePublished": "2017-05-06T00:00:00.000Z",
"dateReserved": "2017-04-18T00:00:00.000Z",
"dateUpdated": "2024-08-05T16:19:28.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.