411
Reference Description
CVE-2003-0768 XSS protection mechanism only checks for sequences with an alphabetical
character following a (<), so a non-alphabetical or null character (%00)
following a < may be processed.
https://www.cve.org/CVERecord?id=CVE-2003-0768
CVE-2004-0189 Decoding function in proxy allows regular expression bypass in ACLs via URLs
with null characters.
https://www.cve.org/CVERecord?id=CVE-2004-0189
CVE-2005-3153 Null byte bypasses PHP regexp check (interaction error).
https://www.cve.org/CVERecord?id=CVE-2005-3153
CVE-2005-4155 Null byte bypasses PHP regexp check (interaction error).
https://www.cve.org/CVERecord?id=CVE-2005-4155
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Notes
Relationship
This can be a factor in multiple interpretation errors, other interaction errors, filename
equivalence, etc.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Null Character / Null Byte
WASC 28 Null Byte Injection
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
52 Embedding NULL Bytes
53 Postfix, Null Terminate, and Backslash
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-159: Improper Handling of Invalid Use of Special Elements
Weakness ID : 159
Structure : Simple
Abstraction : Class
Description
The product does not properly filter, remove, quote, or otherwise manage the invalid use of special
elements in user-controlled input, which could cause adverse effect on its behavior and integrity.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-159: Improper Handling of Invalid Use of Special Elements
CWE-159: Improper Handling of Invalid Use of Special Elements