447
Reference Description
https://www.cve.org/CVERecord?id=CVE-2000-0498
CVE-2001-0766 A URL that contains some characters whose case is not matched by the
server's filters may bypass access restrictions because the case-insensitive file
system will then handle the request after it bypasses the case sensitive filter.
https://www.cve.org/CVERecord?id=CVE-2001-0766
CVE-2001-0795 Server allows remote attackers to obtain source code of CGI scripts via URLs
that contain MS-DOS conventions such as (1) upper case letters or (2) 8.3 file
names.
https://www.cve.org/CVERecord?id=CVE-2001-0795
CVE-2001-1238 Task Manager does not allow local users to end processes with uppercase
letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4)
services.exe via the Process tab which could allow local users to install Trojan
horses that cannot be stopped.
https://www.cve.org/CVERecord?id=CVE-2001-1238
CVE-2003-0411 chain: Code was ported from a case-sensitive Unix platform to a caseinsensitive
Windows platform where filetype handlers treat .jsp and .JSP as
different extensions. JSP source code may be read because .JSP defaults to
the filetype "text".
https://www.cve.org/CVERecord?id=CVE-2003-0411
CVE-2002-0485 Leads to interpretation error
https://www.cve.org/CVERecord?id=CVE-2002-0485
CVE-1999-0239 Directories may be listed because lower case web requests are not properly
handled by the server.
https://www.cve.org/CVERecord?id=CVE-1999-0239
CVE-2005-0269 File extension check in forum software only verifies extensions that contain all
lowercase letters, which allows remote attackers to upload arbitrary files via file
extensions that include uppercase letters.
https://www.cve.org/CVERecord?id=CVE-2005-0269
CVE-2004-1083 Web server restricts access to files in a case sensitive manner, but the
filesystem accesses files in a case insensitive manner, which allows remote
attackers to read privileged files using alternate capitalization.
https://www.cve.org/CVERecord?id=CVE-2004-1083
CVE-2002-2119 Case insensitive passwords lead to search space reduction.
https://www.cve.org/CVERecord?id=CVE-2002-2119
CVE-2004-2214 HTTP server allows bypass of access restrictions using URIs with mixed case.
https://www.cve.org/CVERecord?id=CVE-2004-2214
CVE-2004-2154 Mixed upper/lowercase allows bypass of ACLs.
https://www.cve.org/CVERecord?id=CVE-2004-2154
CVE-2005-4509 Bypass malicious script detection by using tokens that aren't case sensitive.
https://www.cve.org/CVERecord?id=CVE-2005-4509
CVE-2002-1820 Mixed case problem allows "admin" to have "Admin" rights (alternate name
property).
https://www.cve.org/CVERecord?id=CVE-2002-1820
CVE-2007-3365 Chain: uppercase file extensions causes web server to return script source
code instead of executing the script.
https://www.cve.org/CVERecord?id=CVE-2007-3365
CVE-2021-39155 Chain: A microservice integration and management platform compares the
hostname in the HTTP Host header in a case-sensitive way (CWE-178,
CWE-1289), allowing bypass of the authorization policy (CWE-863) using a
hostname with mixed case or other variations.
https://www.cve.org/CVERecord?id=CVE-2021-39155
Functional Areas
CWE Version 4.14
CWE-179: Incorrect Behavior Order: Early Validation
CWE-179: Incorrect Behavior Order: Early Validation