31
As of 2020, this entry is used more often than preferred, and it is a source of frequent confusion.
It is being actively modified for CWE 4.1 and subsequent versions.
Maintenance
Concepts such as validation, data transformation, and neutralization are being refined, so
relationships between CWE-20 and other entries such as CWE-707 may change in future
versions, along with an update to the Vulnerability Theory document.
Maintenance
Input validation - whether missing or incorrect - is such an essential and widespread part of
secure development that it is implicit in many different weaknesses. Traditionally, problems such
as buffer overflows and XSS have been classified as input validation problems by many security
professionals. However, input validation is not necessarily the only protection mechanism
available for avoiding such problems, and in some cases it is not even sufficient. The CWE team
has begun capturing these subtleties in chains within the Research Concepts view (CWE-1000),
but more work is needed.
Terminology
The "input validation" term is extremely common, but it is used in many different ways. In some
cases its usage can obscure the real underlying weakness or otherwise hide chaining and
composite relationships. Some people use "input validation" as a general term that covers
many different neutralization techniques for ensuring that input is appropriate, such as filtering,
canonicalization, and escaping. Others use the term in a more narrow context to simply mean
"checking if an input conforms to expectations without changing it." CWE uses this more narrow
interpretation.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Input validation and representation
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
CERT C Secure Coding ERR07-
C
Prefer functions that support error
checking over equivalent functions that
don't
CERT C Secure Coding FIO30-C CWE More
Abstract
Exclude user input from format strings
CERT C Secure Coding MEM10-
C
Define and use a pointer validation
function
WASC 20 Improper Input Handling
Software Fault Patterns SFP25 Tainted input to variable
Related Attack Patterns
CAPEC-ID Attack Pattern Name
3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
7 Blind SQL Injection
8 Buffer Overflow in an API Call
9 Buffer Overflow in Local Command-Line Utilities
10 Buffer Overflow via Environment Variables
13 Subverting Environment Variable Values
14 Client-side Injection-induced Buffer Overflow
22 Exploiting Trust in Client
23 File Content Injection
24 Filter Failure through Buffer Overflow
28 Fuzzing
31 Accessing/Intercepting/Modifying HTTP Cookies
42 MIME Conversion
CWE Version 4.14
CWE-20: Improper Input Validation
CWE-20: Improper Input Validation