1404
Demonstrative Examples
Example 1:
The IPSEC specification is complex, which resulted in bugs, partial implementations, and
incompatibilities between vendors.
Example 2:
HTTP Request Smuggling (CWE-444) attacks are feasible because there are not stringent
requirements for how illegal or inconsistent HTTP headers should be handled. This can lead to
inconsistent implementations in which a proxy or firewall interprets the same data stream as a
different set of requests than the end points in that stream.
Observed Examples
Reference Description
CVE-2007-6067 Support for complex regular expressions leads to a resultant algorithmic
complexity weakness (CWE-407).
https://www.cve.org/CVERecord?id=CVE-2007-6067
CVE-2007-1552 Either a filename extension and a Content-Type header could be used to
infer the file type, but the developer only checks the Content-Type, enabling
unrestricted file upload (CWE-434).
https://www.cve.org/CVERecord?id=CVE-2007-1552
CVE-2007-6479 In Apache environments, a "filename.php.gif" can be redirected to the PHP
interpreter instead of being sent as an image/gif directly to the user. Not
knowing this, the developer only checks the last extension of a submitted
filename, enabling arbitrary code execution.
https://www.cve.org/CVERecord?id=CVE-2007-6479
CVE-2005-2148 The developer cleanses the $_REQUEST superglobal array, but PHP also
populates $_GET, allowing attackers to bypass the protection mechanism and
conduct SQL injection attacks against code that uses $_GET.
https://www.cve.org/CVERecord?id=CVE-2005-2148
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
References
[REF-196]Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer
Systems". Proceedings of the IEEE 63. 1975 September. < http://web.mit.edu/Saltzer/www/
publications/protection/ >.
[REF-524]Sean Barnum and Michael Gegick. "Economy of Mechanism". 2005 September 3. <
https://web.archive.org/web/20220126060058/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/economy-of-mechanism >.2023-04-07.
CWE-638: Not Using Complete Mediation
Weakness ID : 638
Structure : Simple
Abstraction : Class
CWE Version 4.14
CWE-638: Not Using Complete Mediation
CWE-638: Not Using Complete Mediation