CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.0)  
Search by ID:

CWE-21: Pathname Traversal and Equivalence Errors

Individual Definition in a New Window
Pathname Traversal and Equivalence Errors
Status: Incomplete
Category ID: 21 (Category)
Description
Summary

Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered. The manipulations generally involve special characters or sequences in pathnames, or the use of alternate references or channels. They can be used to access files outside of a restricted directory (path traversal or link following) or to access files that are otherwise protected (path equivalence).

Potential Mitigations

Assume all input is malicious. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system.

Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class20Insufficient Input Validation
Development Concepts (primary)699
ParentOfWeakness ClassWeakness ClassWeakness Class22Path Traversal
Development Concepts (primary)699
ParentOfWeakness BaseWeakness BaseWeakness Base41Failure to Resolve Path Equivalence
Development Concepts (primary)699
ParentOfWeakness BaseWeakness BaseWeakness Base59Failure to Resolve Links Before File Access (aka 'Link Following')
Development Concepts (primary)699
ParentOfWeakness BaseWeakness BaseWeakness Base66Failure to Handle File Names that Identify Virtual Resources
Development Concepts (primary)699
Taxonomy Mappings
Mapped Taxonomy NameMapped Node Name
PLOVERPathname Traversal and Equivalence Errors
Applicable Platforms
Languages
All
Related Attack Patterns
CAPEC-ID(CAPEC Version 1.1)Attack Pattern Name
80Using UTF-8 Encoding to Bypass Validation Logic
79Using Slashes in Alternate Encoding
72URL Encoding
64Using Slashes and URL Encoding Combined to Bypass Validation Logic
78Using Escaped Slashes in Alternate Encoding
Content History
Submissions
PLOVER. (Externally Mined)
Modifications
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Relationships, Taxonomy_Mappings, Type
Page Last Updated: September 10, 2008