2142
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Effectiveness = High
Observed Examples
Reference Description
CVE-2021-39155 Chain: A microservice integration and management platform compares the
hostname in the HTTP Host header in a case-sensitive way (CWE-178,
CWE-1289), allowing bypass of the authorization policy (CWE-863) using a
hostname with mixed case or other variations.
https://www.cve.org/CVERecord?id=CVE-2021-39155
CVE-2020-11053 Chain: Go-based Oauth2 reverse proxy can send the authenticated user to
another site at the end of the authentication flow. A redirect URL with HTMLencoded
whitespace characters can bypass the validation (CWE-1289) to
redirect to a malicious site (CWE-601)
https://www.cve.org/CVERecord?id=CVE-2020-11053
CVE-2005-0269 File extension check in forum software only verifies extensions that contain all
lowercase letters, which allows remote attackers to upload arbitrary files via file
extensions that include uppercase letters.
https://www.cve.org/CVERecord?id=CVE-2005-0269
CVE-2001-1238 Task Manager does not allow local users to end processes with uppercase
letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4)
services.exe via the Process tab which could allow local users to install Trojan
horses that cannot be stopped.
https://www.cve.org/CVERecord?id=CVE-2001-1238
CVE-2004-2214 HTTP server allows bypass of access restrictions using URIs with mixed case.
https://www.cve.org/CVERecord?id=CVE-2004-2214
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
Notes
Maintenance
This entry is still under development and will continue to see updates and content improvements.
CWE-1290: Incorrect Decoding of Security Identifiers
Weakness ID : 1290
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-1290: Incorrect Decoding of Security Identifiers
CWE-1290: Incorrect Decoding of Security Identifiers