이름: Incomplete Comparison with Missing Factors

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

일반 정보

취약점 도입 방식

Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

기술

클래스: Not Technology-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Integrity Access Control	Alter Execution Logic, Bypass Protection Mechanism 참고: An incomplete comparison can lead to resultant weaknesses, e.g., by operating on the wrong object or making a security decision without considering a required factor.

관찰된 예시

참고 자료	설명
CVE-2005-2782	PHP remote file inclusion in web application that filters "http" and "https" URLs, but not "ftp".
CVE-2014-6394	Product does not prevent access to restricted directories due to partial string comparison with a public directory

탐지 방법

Manual Static Analysis

Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

취약점 매핑 메모

근거 : This CWE entry is a Class and might have Base-level children that would be more appropriate
댓글 : Examine children of this entry to see if there is a better fit

제출

이름	조직	날짜	출시일	Version
CWE Content Team	MITRE	2018-01-04 +00:00	2018-03-29 +00:00	3.1

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2019-01-03 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Description, Relationships, Type
CWE Content Team	MITRE	2021-03-15 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Common_Consequences, Description
CWE Content Team	MITRE	2026-04-30 +00:00	updated Detection_Factors, Potential_Mitigations

CWE-1023 상세 정보

CWE-1023