Use of Incorrect Operator

Opis

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

These types of errors are generally the result of a typo by the programmer.

Skutki

• Other

  Alter Execution Logic

  This weakness can cause unintended logic to be executed and other unexpected application behavior.

Przykłady podatności

• CVE-2022-3979 Chain: data visualization program written in PHP uses the "!=" operator instead of the type-strict "!==" operator (CWE-480) when validating hash values, potentially leading to an incorrect type conversion (CWE-704)
• CVE-2021-3116 Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)

Słabość nadrzędna

• CWE-670 Always-Incorrect Control Flow Implementation

Słabości podrzędne

• CWE-481 Assigning instead of Comparing
• CWE-482 Comparing instead of Assigning
• CWE-597 Use of Wrong Operator in String Comparison

Kiedy powstaje

• Implementation

Dotyczy

C, C++, Perl, Not Language-Specific

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 6, "Typos", Page 289, Addison Wesley, 2006
3. csr_regile.sv line 938 — 2021
4. Fix for csr_regfile.sv line 938 — 2021