CWE-46: Path Equivalence: 'filename ' (Trailing Space)
Path Equivalence: 'filename ' (Trailing Space)
Weakness ID: 46 (Weakness Variant) Status: Incomplete
Description
Description Summary
A software system that accepts path input in the form of
trailing space ('filedir ') without appropriate validation can lead to ambiguous
path resolution and allow an attacker to traverse the file system to unintended
locations or access arbitrary files.
Time of Introduction
Observed Examples
Reference Description CVE-2001-0693 Source disclosure via trailing encoded space
"%20" CVE-2001-0778 Source disclosure via trailing encoded space
"%20" CVE-2001-1248 Source disclosure via trailing encoded space
"%20" CVE-2004-0280 Source disclosure via trailing encoded space
"%20" CVE-2004-2213 Source disclosure via trailing encoded space
"%20" CVE-2005-0622 Source disclosure via trailing encoded space
"%20" CVE-2005-1656 Source disclosure via trailing encoded space
"%20" CVE-2002-1603 Source disclosure via trailing encoded space
"%20" CVE-2001-0054 Multi-Factor Vulnerability (MVF). directory
traversal and other issues in FTP server using Web encodings such as "%20";
certain manipulations have unusual side
effects. CVE-2002-1451 Trailing space ("+" in query string) leads to
source code disclosure.
Potential Mitigations
Phase Description see the vulnerability category "Path Equivalence"
Relationships
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Trailing Space - 'filedir '
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time of Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships,
Taxonomy Mappings
Description
