VOOZH about

URL: https://cwe.mitre.org/data/definitions/227.html

⇱ CWE - CWE-227: CWE CATEGORY: 7PK - API Abuse (4.20)

👁 CWE

Common Weakness Enumeration

A community-developed list of SW & HW weaknesses that can become vulnerabilities

👁 New to CWE? click here!
👁 CWE Most Important Hardware Weaknesses
👁 CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE- Individual Dictionary Definition (4.20)  
CWE Glossary Definition
 👁 x

CWE CATEGORY: 7PK - API Abuse

Category ID: 227
Vulnerability Mapping: PROHIBITED This CWE ID must not be used to map to real-world vulnerabilities
👁 +
Summary
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
👁 +
Membership
Nature Type ID Name
MemberOf 👁 View
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).		 700 Seven Pernicious Kingdoms
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 1001 SFP Secondary Cluster: Use of an Improper API
HasMember 👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.		 242 Use of Inherently Dangerous Function
HasMember 👁 Variant
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.		 243 Creation of chroot Jail Without Changing Working Directory
HasMember 👁 Variant
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.		 244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')
HasMember 👁 Variant
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.		 245 J2EE Bad Practices: Direct Management of Connections
HasMember 👁 Variant
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.		 246 J2EE Bad Practices: Direct Use of Sockets
HasMember 👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.		 248 Uncaught Exception
HasMember 👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.		 250 Execution with Unnecessary Privileges
HasMember 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 251 Often Misused: String Management
HasMember 👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.		 252 Unchecked Return Value
HasMember 👁 Variant
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.		 558 Use of getlogin() in Multithreaded Application
👁 +
Vulnerability Mapping Notes

Usage: PROHIBITED

(this CWE ID must not be used to map to real-world vulnerabilities)

Reason: Category

Rationale:

This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.

Comments:

See member weaknesses of this category.
👁 +
References
[REF-6] Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools Techniques and Metrics. NIST. 2005-11-07. <https://samate.nist.gov/SSATTM_Content/papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf>.
👁 +
Content History
👁 +
Submissions
Submission Date Submitter Organization
2006-07-19
(CWE Draft 3, 2006-07-19) 		7 Pernicious Kingdoms
👁 +
Modifications
Modification Date Modifier Organization
2023-06-29
(CWE 4.12, 2023-06-29) 		CWE Content Team MITRE
updated Mapping_Notes
2023-04-27
(CWE 4.11, 2023-04-27) 		CWE Content Team MITRE
updated Mapping_Notes
2020-02-24
(CWE 4.0, 2020-02-24) 		CWE Content Team MITRE
updated Description, References, Relationships
2019-01-03
(CWE 3.2, 2019-01-03) 		CWE Content Team MITRE
updated Relationships
2017-11-08
(CWE 3.0, 2017-11-08) 		CWE Content Team MITRE
updated Alternate_Terms, Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type
2017-05-03
(CWE 2.11, 2017-05-05) 		CWE Content Team MITRE
updated Observed_Examples, Related_Attack_Patterns
2017-01-19
(CWE 2.10, 2017-01-19) 		CWE Content Team MITRE
updated Relationships
2014-07-30
(CWE 2.8, 2014-07-31) 		CWE Content Team MITRE
updated Relationships
2013-07-17
(CWE 2.5, 2013-07-17) 		CWE Content Team MITRE
updated Relationships
2012-10-30
(CWE 2.3, 2012-10-30) 		CWE Content Team MITRE
updated Observed_Examples, Potential_Mitigations
2012-05-11
(CWE 2.2, 2012-05-15) 		CWE Content Team MITRE
updated Relationships
2011-06-27
(CWE 2.0, 2011-06-27) 		CWE Content Team MITRE
updated Common_Consequences
2011-06-01
(CWE 1.13, 2011-06-01) 		CWE Content Team MITRE
updated Common_Consequences
2011-03-29
(CWE 1.12, 2011-03-30) 		CWE Content Team MITRE
updated Description, Name
2010-12-13
(CWE 1.11, 2010-12-13) 		CWE Content Team MITRE
updated Description
2010-02-16
(CWE 1.8, 2010-02-16) 		CWE Content Team MITRE
updated Relationships, Taxonomy_Mappings
2009-05-27
(CWE 1.4, 2009-05-27) 		CWE Content Team MITRE
updated Name, Relationships
2008-09-08
(CWE 1.0, 2008-09-09) 		CWE Content Team MITRE
updated Description, Relationships, Taxonomy_Mappings
2008-07-01
(CWE 1.0, 2008-09-09) 		Eric Dalci Cigital
updated Time_of_Introduction
👁 +
Previous Entry Names
Change Date Previous Entry Name
2008-04-11 API Abuse
2009-05-27 Failure to Fulfill API Contract (aka 'API Abuse')
2011-03-29 Failure to Fulfill API Contract ('API Abuse')
2017-11-08 Improper Fulfillment of API Contract ('API Abuse')
More information is available — Please edit the custom filter or select a different filter.
Page Last Updated: April 30, 2026

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.