22
Related Attack Patterns
CAPEC-ID Attack Pattern Name
64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
76 Manipulating Web Input to File System Calls
78 Using Escaped Slashes in Alternate Encoding
79 Using Slashes in Alternate Encoding
126 Path Traversal
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-185]OWASP. "Testing for Path Traversal (OWASP-AZ-001)". < http://www.owasp.org/
index.php/Testing_for_Path_Traversal_(OWASP-AZ-001) >.
[REF-186]Johannes Ullrich. "Top 25 Series - Rank 7 - Path Traversal". 2010 March 9. SANS
Software Security Institute. < https://www.sans.org/blog/top-25-series-rank-7-path-traversal/
>.2023-04-07.
CWE Version 4.14
CWE-23: Relative Path Traversal
CWE-23: Relative Path Traversal