463
CAPEC-ID Attack Pattern Name
182 Flash Injection
References
[REF-140]Greg Hoglund and Gary McGraw. "Exploiting Software: How to Break Code". 2004
February 7. Addison-Wesley. < https://www.amazon.com/Exploiting-Software-How-Break-Code/
dp/0201786958 >.2023-04-07.
[REF-141]Steve Christey. "Blacklist defenses as a breeding ground for vulnerability variants". 2006
February 3. < https://seclists.org/fulldisclosure/2006/Feb/40 >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-185: Incorrect Regular Expression
Weakness ID : 185
Structure : Simple
Abstraction : Class
Description
The product specifies a regular expression in a way that causes data to be improperly matched or
compared.
Extended Description
When the regular expression is used in protection mechanisms such as filtering or validation, this
may allow an attacker to bypass the intended restrictions on the incoming data.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 697 Incorrect Comparison 1530
ParentOf 186 Overly Restrictive Regular Expression 466
ParentOf 625 Permissive Regular Expression 1392
CanPrecede 182 Collapse of Data into Unsafe Value 455
CanPrecede 187 Partial String Comparison 467
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Unexpected State
Varies by Context
When the regular expression is not correctly specified,
data might have a different format or type than the rest of
the program expects, producing resultant weaknesses or
errors.
Access Control Bypass Protection Mechanism
CWE Version 4.14
CWE-185: Incorrect Regular Expression
CWE-185: Incorrect Regular Expression