CWE-182
Collapse of Data into Unsafe Value
2006-07-19
00h00 +00:00
00h00 +00:00
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
이름: Collapse of Data into Unsafe Value
The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.
일반 정보
취약점 도입 방식
Implementation적용 가능한 플랫폼
언어
클래스: Not Language-Specific (Undetermined)기술
클래스: Not Technology-Specific (Undetermined)일반적인 결과
| 범위 | 영향 | 가능성 |
|---|---|---|
| Access Control | Bypass Protection Mechanism |
관찰된 예시
| 참고 자료 | 설명 |
|---|---|
CVE-2004-0815 | "/.////" in pathname collapses to absolute path. |
CVE-2005-3123 | "/.//..//////././" is collapsed into "/.././" after ".." and "//" sequences are removed. |
CVE-2002-0325 | ".../...//" collapsed to "..." due to removal of "./" in web server. |
CVE-2002-0784 | Chain: HTTP server protects against ".." but allows "." variants such as "////./../.../". If the server removes "/.." sequences, the result would collapse into an unsafe value "////../" (CWE-182). |
CVE-2005-2169 | Chain: ".../...//" bypasses protection mechanism using regexp's that remove "../" resulting in collapse into an unsafe value "../" (CWE-182) and resultant path traversal. |
CVE-2001-1157 | XSS protection mechanism strips a |