Incorrect Comparison

Opis

The product compares two entities in a security-relevant context, but the comparison is incorrect.

This Pillar covers several possibilities:

- the comparison checks one factor incorrectly;

- the comparison should consider multiple factors, but it does not check at least one of those factors at all;

- the comparison checks the wrong factor.

Skutki

• Other

  Varies by Context

  When the comparison is incorrect, it may lead to resultant weaknesses.

Przykłady podatności

• CVE-2021-3116 Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)
• CVE-2020-15811 Chain: Proxy uses a substring search instead of parsing the Transfer-Encoding header (CWE-697), allowing request splitting (CWE-113) and cache poisoning
• CVE-2016-10003 Proxy performs incorrect comparison of request headers, leading to infoleak

Słabości podrzędne

• CWE-183 Permissive List of Allowed Inputs
• CWE-185 Incorrect Regular Expression
• CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined
• CWE-1023 Incomplete Comparison with Missing Factors
• CWE-1024 Comparison of Incompatible Types
• CWE-1025 Comparison Using Wrong Factors
• CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
• CWE-1077 Floating Point Comparison with Incorrect Operator
• CWE-1254 Incorrect Comparison Logic Granularity

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

Weaknesses related to this Pillar appear to be under-studied, especially with respect to classification schemes. Input from academic and other communities could help identify and resolve gaps or organizational difficulties within CWE.

This entry likely has some relationships with case sensitivity (CWE-178), but case sensitivity is a factor in other types of weaknesses besides comparison. Also, in cryptography, certain attacks are possible when certain comparison operations do not take place in constant time, causing a timing-related information leak (CWE-208).