445
CAPEC-ID Attack Pattern Name
64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
72 URL Encoding
120 Double Encoding
468 Generic Cross-Browser Cross-Domain Theft
CWE-178: Improper Handling of Case Sensitivity
Weakness ID : 178
Structure : Simple
Abstraction : Base
Description
The product does not properly account for differences in case sensitivity when accessing or
determining the properties of a resource, leading to inconsistent results.
Extended Description
Improperly handled case sensitive data can lead to several possible consequences, including:
• case-insensitive passwords reducing the size of the key space, making brute force attacks
easier
• bypassing filters or access controls using alternate names
• multiple interpretation errors using alternate names.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 706 Use of Incorrectly-Resolved Name or Reference 1544
PeerOf 1289 Improper Validation of Unsafe Equivalence in Input 2141
CanPrecede 289 Authentication Bypass by Alternate Name 703
CanPrecede 433 Unparsed Raw Web Content Delivery 1046
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 706 Use of Incorrectly-Resolved Name or Reference 1544
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 19 Data Processing Errors 2309
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Potential Mitigations
CWE Version 4.14
CWE-178: Improper Handling of Case Sensitivity
CWE-178: Improper Handling of Case Sensitivity