The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
This weakness covers three distinct situations. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.

Primary

Resultant

Architecture and Design

Implementation

Operation

Access Control
Bypass Protection Mechanism

Discouraged
This CWE entry is extremely high-level, a Pillar.
Consider children or descendants of this entry instead.

The concept of protection mechanisms is well established, but protection mechanism failures have not been studied comprehensively. It is suspected that protection mechanisms can have significantly different types of weaknesses than the weaknesses that they are intended to prevent.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Other_Notes

CWE Content Team
MITRE
2009-01-12
updated Relationships

CWE Content Team
MITRE
2009-03-10
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2009-05-27
updated Description, Related_Attack_Patterns

CWE Content Team
MITRE
2009-07-27
updated Relationships

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2011-03-29
updated Maintenance_Notes, Other_Notes, Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2013-02-21
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Relationships

CWE Content Team
MITRE
2014-02-18
updated Related_Attack_Patterns

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2018-03-27
updated Relationships

CWE Content Team
MITRE
2019-01-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Related_Attack_Patterns, Relationships, Type

CWE Content Team
MITRE
2020-06-25
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Maintenance_Notes

CWE Content Team
MITRE
2021-07-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities