376
Relationship
See this entry's children for different types of special elements that have been observed at one
point or another. However, it can be difficult to find suitable CVE examples. In an attempt to be
complete, CWE includes some types that do not have any associated observed example.
Research Gap
This weakness is probably under-studied for proprietary or custom formats. It is likely that these
issues are fairly common in applications that use their own custom format for configuration files,
logs, meta-data, messaging, etc. They would only be found by accident or with a focused effort
based on an understanding of the format.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Special Elements (Characters or
Reserved Words)
PLOVER Custom Special Character Injection
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
15 Command Delimiters
34 HTTP Response Splitting
105 HTTP Request Splitting
CWE-140: Improper Neutralization of Delimiters
Weakness ID : 140
Structure : Simple
Abstraction : Base
Description
The product does not neutralize or incorrectly neutralizes delimiters.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 138 Improper Neutralization of Special Elements 373
ParentOf 141 Improper Neutralization of Parameter/Argument Delimiters 378
ParentOf 142 Improper Neutralization of Value Delimiters 380
ParentOf 143 Improper Neutralization of Record Delimiters 381
ParentOf 144 Improper Neutralization of Line Delimiters 383
ParentOf 145 Improper Neutralization of Section Delimiters 385
ParentOf 146 Improper Neutralization of Expression/Command Delimiters 387
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 137 Data Neutralization Issues 2311
Common Consequences
CWE Version 4.14
CWE-140: Improper Neutralization of Delimiters
CWE-140: Improper Neutralization of Delimiters