Tested fixes for CWE-330 in Express, Flask, Spring Boot, ASP.NET Core and net/http: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
The description above is MITRE’s definition of CWE-330 in CWE 4.20, a class-level weakness.
Common consequences MITRE lists
- Confidentiality, Other: Other
- Access Control, Other: Bypass Protection Mechanism; Other
- Access Control: Bypass Protection Mechanism; Gain Privileges or Assume Identity
Closest guides
These guides cover the nearest controls and techniques; use them with the references below.
Choose cryptographic algorithms and parameters by job
A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.
Secrets management: storage, rotation and leaked-secret response
Follow one application credential from issuance through caching, rotation, revocation and restored backups, prove that its old value stops working, and respond correctly when a secret leaks.
Weak RSA key generation: shared primes, ROCA and safe keys
Recover a toy RSA factor with a greatest common divisor, distinguish shared primes, structured primes, duplicate keys and key length, and check a fleet of real public keys.
Practice
- Insecure randomness lab: Generate unguessable API keys · Browser lab
References
This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-330.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.