1764
Nature Type ID Name Page
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
CWE-838: Inappropriate Encoding for Output Context
Weakness ID : 838
Structure : Simple
Abstraction : Base
Description
The product uses or specifies an encoding when generating output to a downstream component,
but the specified encoding is not the same as the encoding that is expected by the downstream
component.
Extended Description
This weakness can cause the downstream component to use a decoding method that produces
different data than what the product intended to send. When the wrong encoding is used - even
if closely related - the downstream component could decode the data incorrectly. This can have
security consequences when the provided boundaries between control and data are inadvertently
broken, because the resulting data could introduce control characters or special elements that were
not sent by the product. The resulting data could then be used to bypass protection mechanisms
such as input validation, and enable injection attacks.
While using output encoding is essential for ensuring that communications between components
are accurate, the use of the wrong encoding - even if closely related - could cause the downstream
component to misinterpret the output.
For example, HTML entity encoding is used for elements in the HTML body of a web page.
However, a programmer might use entity encoding when generating output for that is used within
an attribute of an HTML tag, which could contain functional Javascript that is not affected by the
HTML encoding.
While web applications have received the most attention for this problem, this weakness could
potentially apply to any type of product that uses a communications stream that could support
multiple encodings.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 116 Improper Encoding or Escaping of Output 281
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 116 Improper Encoding or Escaping of Output 281
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-838: Inappropriate Encoding for Output Context
CWE-838: Inappropriate Encoding for Output Context