107
Scope Impact Likelihood
Integrity Modify Files or Directories
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2000-0004 Server allows remote attackers to read source code for executable files by
inserting a . (dot) into the URL.
https://www.cve.org/CVERecord?id=CVE-2000-0004
CVE-2002-0304 Server allows remote attackers to read password-protected files via a /./ in the
HTTP request.
https://www.cve.org/CVERecord?id=CVE-2002-0304
CVE-1999-1083 Possibly (could be a cleansing error)
https://www.cve.org/CVERecord?id=CVE-1999-1083
CVE-2004-0815 "/./////etc" cleansed to ".///etc" then "/etc"
https://www.cve.org/CVERecord?id=CVE-2004-0815
CVE-2002-0112 Server allows remote attackers to view password protected files via /./ in the
URL.
https://www.cve.org/CVERecord?id=CVE-2002-0112
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER /./ (single dot directory)
Software Fault Patterns SFP16 Path Traversal
CWE-56: Path Equivalence: 'filedir*' (Wildcard)
Weakness ID : 56
Structure : Simple
Abstraction : Variant
Description
The product accepts path input in the form of asterisk wildcard ('filedir*') without appropriate
validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file
system to unintended locations or access arbitrary files.
Relationships
CWE Version 4.14
CWE-57: Path Equivalence: 'fakedir/../realdir/filename'
CWE-57: Path Equivalence: 'fakedir/../realdir/filename'