CWE WEAKNESSES / CWE-459
CWE-459
Incomplete Cleanup
Base
What it is
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Impact
| Other, Confidentiality, Integrity | Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other) |
Mitigations
- [Architecture and Design, Implementation] Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Real-world CVE examples
- CVE-2000-0552 — World-readable temporary file not deleted after use.
- CVE-2005-2293 — Temporary file not deleted after use, leaking database usernames and passwords.
- CVE-2002-0788 — Interaction error creates a temporary file that can not be deleted due to strong permissions.
- CVE-2002-2066 — Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2067 — Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2068 — Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2069 — Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2070 — Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2005-1744 — Users not logged out when application is restarted after security-relevant changes were made.
Related weaknesses
Test & detect
Browse all common weaknesses, check related exploited CVEs, or map to ATT&CK techniques.
Source: MITRE CWE. View on cwe.mitre.org →