1426
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Server (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
An attacker may be able to read sensitive data.
Availability DoS: Crash, Exit, or Restart
An attacker may be able to cause a denial of service.
Access Control Gain Privileges or Assume Identity
An attacker may be able to gain privileges.
Potential Mitigations
Phase: Architecture and Design
Make decisions on the server side based on file content and not on file name or extension.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Related Attack Patterns
CAPEC-ID Attack Pattern Name
209 XSS Using MIME Type Mismatch
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Weakness ID : 647
Structure : Simple
Abstraction : Variant
Description
The product defines policy namespaces and makes authorization decisions based on the
assumption that a URL is canonical. This can allow a non-canonical URL to bypass the
authorization.
Extended Description
If an application defines policy namespaces and makes authorization decisions based on the URL,
but it does not require or convert to a canonical URL before making the authorization decision,
CWE Version 4.14
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions