1684
will have the first "../" stripped, resulting in:
Example Language: (Result)
../../etc/passwd
This value is then concatenated with the /home/user/ directory:
Example Language: (Result)
/home/user/../../etc/passwd
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../
sequences in the pathname. This leads to relative path traversal (CWE-23).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements
Weakness ID : 794
Structure : Simple
Abstraction : Variant
Description
The product receives data from an upstream component, but does not filter all instances of a
special element before sending it to a downstream component.
Extended Description
Incomplete filtering of this nature may be applied to:
• sequential elements (special elements that appear next to each other) or
• non-sequential elements (special elements that appear multiple times in different locations).
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 792 Incomplete Filtering of One or More Instances of Special
Elements