Incomplete Comparison with Missing Factors

Opis

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Skutki

• Integrity, Access Control

  Alter Execution Logic; Bypass Protection Mechanism

  An incomplete comparison can lead to resultant weaknesses, e.g., by operating on the wrong object or making a security decision without considering a required factor.

Przykłady podatności

• CVE-2005-2782 PHP remote file inclusion in web application that filters "http" and "https" URLs, but not "ftp".
• CVE-2014-6394 Product does not prevent access to restricted directories due to partial string comparison with a public directory

Słabość nadrzędna

• CWE-697 Incorrect Comparison

Słabości podrzędne

• CWE-184 Incomplete List of Disallowed Inputs
• CWE-187 Partial String Comparison
• CWE-478 Missing Default Case in Multiple Condition Expression
• CWE-839 Numeric Range Comparison Without Minimum Check

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific