|
|
Status: Incomplete Weakness ID: 57 (Weakness Variant)Description Summary The software contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file. Potential Mitigations see the vulnerability category "Path Equivalence" Observed Examples
Theoretical Notes This is a manipulation that uses an injection for one consequence (containment violation using relative path) to achieve a different consequence (equivalence by alternate name). Relationships
Taxonomy Mappings
Applicable Platforms Languages All Time of Introduction  ImplementationContent History Submissions PLOVER. (Externally Mined) Modifications Eric Dalci. Cigital. 2008-07-01. (External) updated Time_of_Introduction CWE Content Team. MITRE. 2008-09-08. (Internal) updated Relationships, Other_Notes, Taxonomy_Mappings CWE Content Team. MITRE. 2008-10-14. (Internal) updated Description, Name, Observed_Examples, Other_Notes, Theoretical_Notes Previous Entry Names Path Issue - dirname/fakechild/../realchild/filename (changed 2008-04-11) Path Equivalence: 'dirname/fakechild/../realchild/filename' (changed 2008-10-14) |
|
|
|||
