Misinterpretation of Input

Opis

The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Skutki

• Integrity

  Unexpected State

Przykłady podatności

• CVE-2005-2225 Product sees dangerous file extension in free text of a group discussion, disconnects all users.
• CVE-2001-0003 Product does not correctly import and process security settings from another product.

Słabość nadrzędna

• CWE-436 Interpretation Conflict

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific

Uwagi

This concept needs further study. It is likely a factor in several weaknesses, possibly resultant as well. Overlaps Multiple Interpretation Errors (MIE).