Rule Definition
Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.

Violation Code Sample

in the following struts-config.xml file does not contain a mapping for LoginForm2.


    <form-beans>
        <form-bean name="LoginForm1" type="com.vaannila.LoginForm1"/>
    </form-beans>
----------

    <action-mappings>
        <action input="/login.jsp" name="LoginForm1" path="/Login" scope="session" type="com.vaannila.LoginAction1">
            <forward name="success" path="/success.jsp" />
            <forward name="failure" path="/failure.jsp" />
        </action>
        <action input="/login2.jsp" name="LoginForm2" path="/Login" scope="session" type="com.vaannila.LoginAction2">
            <forward name="success" path="/success.jsp" />
            <forward name="failure" path="/failure.jsp" />
        </action>
    </action-mappings>

Fixed Code Sample

in the following struts-config.xml file contain a mapping for each form bean.


    <form-beans>
        <form-bean name="LoginForm1" type="com.vaannila.LoginForm1"/>
        <form-bean name="LoginForm2" type="com.vaannila.LoginForm2"/>
    </form-beans>
----------

    <action-mappings>
        <action input="/login.jsp" name="LoginForm1" path="/Login" scope="session" type="com.vaannila.LoginAction1">
            <forward name="success" path="/success.jsp" />
            <forward name="failure" path="/failure.jsp" />
        </action>
        <action input="/login2.jsp" name="LoginForm2" path="/Login" scope="session" type="com.vaannila.LoginAction2">
            <forward name="success" path="/success.jsp" />
            <forward name="failure" path="/failure.jsp" />
        </action>
    </action-mappings>

https://cwe.mitre.org/data/definitions/563.html