Detail CWE-777

CWE-777

Regular Expression without Anchors
2009-07-27
00h00 +00:00
Sedang
Incomplete
2026-10-28
00h00 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Regular Expression without Anchors

The product uses a regular expression to perform neutralization, but the regular expression omits one or more anchors that may allow malicious or malformed data to slip through.

Informasi Umum

Detail Latar Belakang

Mode Pengenalan

Implementation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)
Nama: Python (Undetermined)

Teknologi

Kelas: Not Technology-Specific (Undetermined)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
Availability
Confidentiality
Access Control		Bypass Protection Mechanism, Varies by Context

Catatan: An unanchored regular expression in the context of an allowlist will possibly result in a protection mechanism failure. Malicious or malformed data may be included before or after any string matching the regular expression, allowing the data to enter trusted regions of the program. The type of malicious data that is allowed will depend on the context of the application and which anchors are omitted from the regular expression. The specific consequences will depend on what functionality the allowlist was protecting.

Contoh yang Diamati

Referensi Deskripsi

CVE-2022-30034

Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).

Mitigasi yang Memungkinkan

Phases : Implementation
Be sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2009-06-30 +00:00 2009-07-27 +00:00 1.5

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2010-06-21 +00:00 updated Description
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2017-11-08 +00:00 updated Likelihood_of_Exploit
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Common_Consequences, Description, Potential_Mitigations
CWE Content Team MITRE 2022-10-13 +00:00 updated Demonstrative_Examples, Observed_Examples
CWE Content Team MITRE 2023-01-31 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Applicable_Platforms, Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Applicable_Platforms, Background_Details, Common_Consequences, Description
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.