455
Reference Description
https://www.cve.org/CVERecord?id=CVE-2002-0934
CVE-2003-0282 Directory traversal vulnerability allows attackers to overwrite arbitrary files via
invalid characters between two . (dot) characters, which are filtered and result
in a ".." sequence.
https://www.cve.org/CVERecord?id=CVE-2003-0282
Functional Areas
• Protection Mechanism
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 992 SFP Secondary Cluster: Faulty Input Transformation 888 2416
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Notes
Research Gap
This category is probably under-studied.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Validate-Before-Filter
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
Related Attack Patterns
CAPEC-ID Attack Pattern Name
3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
43 Exploiting Multiple Input Interpretation Layers
78 Using Escaped Slashes in Alternate Encoding
79 Using Slashes in Alternate Encoding
80 Using UTF-8 Encoding to Bypass Validation Logic
120 Double Encoding
267 Leverage Alternate Encoding
CWE-182: Collapse of Data into Unsafe Value
Weakness ID : 182
Structure : Simple
Abstraction : Base
Description
The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value
that violates an expected security property.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-182: Collapse of Data into Unsafe Value
CWE-182: Collapse of Data into Unsafe Value