CWE-1023
Incomplete Comparison with Missing Factors
2018-03-29
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Incomplete Comparison with Missing Factors
The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.
一般情報
導入モード
Implementation適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)テクノロジー
クラス： Not Technology-Specific (Undetermined)一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Integrity Access Control | Alter Execution Logic, Bypass Protection Mechanism 注記：An incomplete comparison can lead to resultant weaknesses, e.g., by operating on the wrong object or making a security decision without considering a required factor. |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2005-2782 | PHP remote file inclusion in web application that filters "http" and "https" URLs, but not "ftp". |
CVE-2014-6394 | Product does not prevent access to restricted directories due to partial string comparison with a public directory |
検出方法
Manual Static Analysis
Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.脆弱性マッピングノート
理由 : This CWE entry is a Class and might have Base-level children that would be more appropriateコメント : Examine children of this entry to see if there is a better fit
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 3.1 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description, Relationships, Type | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Common_Consequences, Description | |
| CWE Content Team | MITRE | updated Detection_Factors, Potential_Mitigations |
