CWE-453: Insecure Default Variable Initialization

MITRE CWE weakness

Description

The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

Common consequences

• Integrity: Modify Application Data

Mitigations

System Configuration — Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.

References

• CWE page: https://cwe.mitre.org/data/definitions/453.html
• CWE list: https://cwe.mitre.org/data/index.html