|
|
|
|
CWE-180 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Draft 180 (Weakness Variant) | | Description | Summary Software "validates" data before it is canonicalized, which leaves it vulnerable to
certain manipulations that are later removed during canonicalization. Invalid data can then avoid
detection before it is produced by canonicalization. | | Functional Area | Non-specific | | Potential Mitigations | Validate data after attempts to canonicalize the resource name. | | Observed Examples | | | Context Notes | This overlaps other categories. | | Relationships | | | Source Taxonomies | PLOVER - Validate-Before-Canonicalize | | Applicable Platforms | All | | Time of Introduction | Architecture and Design Implementation | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 80 | Using UTF-8 Encoding to Bypass Validation Logic | | 79 | Using Slashes in Alternate Encoding | | 71 | Using Unicode Encoding to Bypass Validation Logic | | 3 | Using Leading 'Ghost' Character Sequences to Bypass Input Filters | | 4 | Using Alternative IP Address Encodings | | 78 | Using Escaped Slashes in Alternate Encoding |
|
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
