The software contains protection mechanisms to restrict access
to 'realdir/filename', but it constructs pathnames using external input in the
form of 'fakedir/../realdir/filename' that are not handled by those mechanisms.
This allows attackers to perform unauthorized actions against the targeted
file.
This is a manipulation that uses an injection for one consequence
(containment violation using relative path) to achieve a different
consequence (equivalence by alternate name).
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
PLOVER
dirname/fakechild/../realchild/filename
Content History
Submissions
Submission Date
Submitter
Organization
Source
PLOVER
Externally Mined
Modifications
Modification Date
Modifier
Organization
Source
2008-07-01
Eric Dalci
Cigital
External
updated Time of Introduction
2008-09-08
CWE Content Team
MITRE
Internal
updated Relationships, Other Notes,
Taxonomy Mappings
2008-10-14
CWE Content Team
MITRE
Internal
updated Description, Name, Observed Examples, Other Notes,
Theoretical Notes
Description
