458
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-183: Permissive List of Allowed Inputs
Weakness ID : 183
Structure : Simple
Abstraction : Base
Description
The product implements a protection mechanism that relies on a list of inputs (or properties of
inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list
is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 697 Incorrect Comparison 1530
ParentOf 942 Permissive Cross-domain Policy with Untrusted Domains 1847
PeerOf 625 Permissive Regular Expression 1392
PeerOf 627 Dynamic Variable Evaluation 1396
CanPrecede 434 Unrestricted Upload of File with Dangerous Type 1048
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1215 Data Validation Issues 2478
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Allowlist / Allow List : This is used by CWE and CAPEC instead of other commonly-used terms.
Its counterpart is denylist.
Safelist / Safe List : This is often used by security tools such as firewalls, email or web gateways,
proxies, etc.
Whitelist / White List : This term is frequently used, but usage has been declining as
organizations have started to adopt other terms.
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Detection Methods
Automated Static Analysis
CWE Version 4.14
CWE-184: Incomplete List of Disallowed Inputs
CWE-184: Incomplete List of Disallowed Inputs