CWE-1125: Excessive Attack Surface

Base

The product has an attack surface whose quantitative measurement exceeds a desirable maximum.

Originating from software security, an "attack surface" measure typically reflects the number of input points and output points that can be utilized by an untrusted party, i.e. a potential attacker. A larger attack surface provides more places to attack, and more opportunities for developers to introduce weaknesses. In some cases, this measure may reflect other aspects of quality besides security; e.g., a product with many inputs and outputs may require a large number of tests in order to improve code coverage.

Consequences

Other: Varies by Context

Recent advisories

GHSA-6jmx-pv77-wm5w — Excessive Attack Surface in pyload-ng
GHSA-vjq3-x3f2-fvxq — Account takeover in facturascripts

All advisories for CWE-1125

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor