The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

Primary

Implementation
This problem typically occurs when the programmer makes a typo, or copy and paste errors.

Other
Quality Degradation

Other
While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers of arguments, such as format strings in C. It also can occur in loosely typed languages or environments. This might require an understanding of intended program behavior or design to determine whether the value is incorrect.

Testing
Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the product. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.

In the following Java snippet, the accessGranted() method is accidentally called with the static ADMIN_ROLES array rather than the user roles.

private static final String[] ADMIN_ROLES = ...;public boolean void accessGranted(String resource, String user) {String[] userRoles = getUserRoles(user);return accessGranted(resource, ADMIN_ROLES);}
private boolean void accessGranted(String resource, String[] userRoles) {

// grant or deny access based on user roles
...
}

CVE-2005-2548
Kernel code specifies the wrong variable in first argument, leading to resultant NULL pointer dereference.
https://www.cve.org/CVERecord?id=CVE-2005-2548

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Detection_Factors, Relationships, Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2009-05-27
updated Description

CWE Content Team
MITRE
2009-10-29
updated Modes_of_Introduction, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2010-02-16
updated Detection_Factors

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Potential_Mitigations

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes