Exposed Dangerous Method or Function (CWE-749)
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
Updated
About CWE-749
MITRE lists these common consequences: Gain Privileges or Assume Identity, Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, affecting integrity, confidentiality, availability, access control.
- MITRE name
- Exposed Dangerous Method or Function
- Abstraction
- Base: abstract, but detailed enough to infer detection and prevention methods
- Status
- Incomplete
Mitigations
- If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.
- Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:
Detection
MITRE lists these detection methods: Automated Static Analysis (high).
CWE-749 in the KEV Catalog
as of 2026-11-12- 6 CISA KEV entries name Exposed Dangerous Method or Function (CWE-749) in their CVE record, tied for 41st among the 194 weaknesses named in the catalog.
- Red Hat has the most CWE-749 entries in the CISA KEV catalog (2).
Related Attack Patterns
1 CAPEC patternsCAPEC-500WebView InjectionDetailed
Loading…
CWE-749 Vulnerabilities
7 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-116779KEV FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands | FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands | signalwire | 9.8 | 2.5% | KEV | 2026-11-05 |
| CVE-2018-19322KEV GIGABYTE Multiple Products Code Execution Vulnerability | GIGABYTE Multiple Products Code Execution Vulnerability | - | 7.8 | 1.8% | KEV | 2018-12-21 |
| CVE-2010-0738KEV Red Hat JBoss Authentication Bypass Vulnerability | Red Hat JBoss Authentication Bypass Vulnerability | - | 3.7 | 73.8% | KEV | 2010-04-28 |
| CVE-2010-1428KEV Red Hat JBoss Information Disclosure Vulnerability | Red Hat JBoss Information Disclosure Vulnerability | - | 5.9 | 52.7% | KEV | 2010-04-28 |
| CVE-2006-1547KEV Apache Struts 1 ActionForm Denial-of-Service Vulnerability | Apache Struts 1 ActionForm Denial-of-Service Vulnerability | - | 7.5 | 54.6% | KEV | 2006-03-30 |
| CVE-2021-36942KEV Windows LSA Spoofing Vulnerability | Windows LSA Spoofing Vulnerability | Microsoft | 7.5 | 66.0% | KEV | 2021-08-12 |
| CVE-2026-22812 OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution | OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution | anomalyco | 8.8 | 16.5% | 2026-01-12 |
Frequently Asked Questions
What is CWE-749?→
CWE-749 (Exposed Dangerous Method or Function) is a MITRE CWE entry. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
How many exploited vulnerabilities are classified as CWE-749?→
This database lists 7 CVE records mapped to CWE-749 by their CVE Numbering Authority. 6 of them are in the CISA Known Exploited Vulnerabilities catalog, and CISA links 4 to known ransomware campaigns. Examples include CVE-2026-116779, CVE-2018-19322, CVE-2010-0738.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not affiliated with or endorsed by MITRE or CISA. Attack patterns from CAPEC 3.9, © The MITRE Corporation, used under the CAPEC Terms of Use.