VOOZH about

URL: https://cwe.mitre.org/data/definitions/694.html

⇱ CWE - CWE-694: Use of Multiple Resources with Duplicate Identifier (4.20)

👁 CWE

Common Weakness Enumeration

A community-developed list of SW & HW weaknesses that can become vulnerabilities

👁 New to CWE? click here!
👁 CWE Most Important Hardware Weaknesses
👁 CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE-694: Use of Multiple Resources with Duplicate Identifier (4.20)  
CWE Glossary Definition
 👁 x

CWE-694: Use of Multiple Resources with Duplicate Identifier

Weakness ID: 694
Vulnerability Mapping: ALLOWED This CWE ID may be used to map to real-world vulnerabilities
Abstraction: Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
View customized information:
For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.
×

Edit Custom Filter


👁 +
Description
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
👁 +
Extended Description
If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.
👁 +
Common Consequences
👁 Section Help
This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Impact Details

Bypass Protection Mechanism

Scope: Access Control
If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.

Quality Degradation

Scope: Other
👁 +
Potential Mitigations
Phase(s) Mitigation

Architecture and Design
Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.
👁 +
 Relationships
👁 Section Help
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
👁 +
Relevant to the view "Research Concepts" (View-1000)
Nature Type ID Name
ChildOf 👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 		99 Improper Control of Resource Identifiers ('Resource Injection')
ChildOf 👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 		573 Improper Following of Specification by Caller
ParentOf 👁 Variant
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 		102 Struts: Duplicate Validation Forms
ParentOf 👁 Variant
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 		462 Duplicate Key in Associative List (Alist)
👁 +
Relevant to the view "Software Development" (View-699)
Nature Type ID Name
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. 		137 Data Neutralization Issues
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. 		399 Resource Management Errors
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. 		1006 Bad Coding Practices
👁 +
Modes Of Introduction
👁 Section Help
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
Phase Note
Architecture and Design
Implementation
👁 +
Applicable Platforms
👁 Section Help
This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
Languages

Class: Not Language-Specific (Undetermined Prevalence)

👁 +
Demonstrative Examples

Example 1


These two Struts validation forms have the same name.

(bad code)
Example Language: XML 
<form-validation>
<formset>
<form name="ProjectForm"> ... </form>
<form name="ProjectForm"> ... </form>
</formset>
</form-validation>

It is not certain which form will be used by Struts. It is critically important that validation logic be maintained and kept in sync with the rest of the product.



👁 +
Selected Observed Examples

Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.

Reference Description
chain: mobile OS verifies cryptographic signature of file in an archive, but then installs a different file with the same name that is also listed in the archive.
👁 +
Weakness Ordinalities
Ordinality Description
Primary
(where the weakness exists independent of other weaknesses)
Resultant
(where the weakness is typically related to the presence of some other weaknesses)
👁 +
Memberships
👁 Section Help
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
Nature Type ID Name
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 984 SFP Secondary Cluster: Life Cycle
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 1409 Comprehensive Categorization: Injection
👁 +
Vulnerability Mapping Notes
Usage ALLOWED
(this CWE ID may be used to map to real-world vulnerabilities)
Reason Acceptable-Use

Rationale

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Comments

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
👁 +
Notes

Relationship

This weakness is probably closely associated with other issues related to doubling, such as CWE-675 (Duplicate Operations on Resource). It's often a case of an API contract violation (CWE-227).
👁 +
Content History
👁 +
Submissions
Submission Date Submitter Organization
2008-09-09
(CWE 1.0, 2008-09-09) 		CWE Content Team MITRE
Note: this date reflects when the entry was first published. Draft versions of this entry were provided to members of the CWE community and modified between Draft 9 and 1.0.
👁 +
Modifications
Modification Date Modifier Organization
2025-12-11
(CWE 4.19, 2025-12-11) 		CWE Content Team MITRE
updated Weakness_Ordinalities
2024-02-29
(CWE 4.14, 2024-02-29) 		CWE Content Team MITRE
updated Demonstrative_Examples
2023-06-29
(CWE 4.12, 2023-06-29) 		CWE Content Team MITRE
updated Mapping_Notes
2023-04-27
(CWE 4.11, 2023-04-27) 		CWE Content Team MITRE
updated Relationships
2023-01-31
(CWE 4.10, 2023-01-31) 		CWE Content Team MITRE
updated Description
2020-02-24
(CWE 4.0, 2020-02-24) 		CWE Content Team MITRE
updated Relationships
2019-06-20
(CWE 3.3, 2019-06-20) 		CWE Content Team MITRE
updated Relationships
2017-11-08
(CWE 3.0, 2017-11-08) 		CWE Content Team MITRE
updated Relevant_Properties
2015-12-07
(CWE 2.9, 2015-12-07) 		CWE Content Team MITRE
updated Relationships
2014-07-30
(CWE 2.8, 2014-07-31) 		CWE Content Team MITRE
updated Relationships
2013-07-17
(CWE 2.5, 2013-07-17) 		CWE Content Team MITRE
updated Applicable_Platforms, Common_Consequences, Description, Observed_Examples, Other_Notes, Potential_Mitigations, Relationship_Notes, Relationships
2012-10-30
(CWE 2.3, 2012-10-30) 		CWE Content Team MITRE
updated Potential_Mitigations
2012-05-11
(CWE 2.2, 2012-05-15) 		CWE Content Team MITRE
updated Relationships
2011-06-27
(CWE 2.0, 2011-06-27) 		CWE Content Team MITRE
updated Common_Consequences
2011-06-01
(CWE 1.13, 2011-06-01) 		CWE Content Team MITRE
updated Common_Consequences
2008-07-01
(CWE 1.0, 2008-09-09) 		Eric Dalci Cigital
updated Potential_Mitigations, Time_of_Introduction
More information is available — Please edit the custom filter or select a different filter.
Page Last Updated: April 30, 2026

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.