87
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 706 Use of Incorrectly-Resolved Name or Reference 1544
ParentOf 42 Path Equivalence: 'filename.' (Trailing Dot) 92
ParentOf 44 Path Equivalence: 'file.name' (Internal Dot) 94
ParentOf 46 Path Equivalence: 'filename ' (Trailing Space) 96
ParentOf 47 Path Equivalence: ' filename' (Leading Space) 97
ParentOf 48 Path Equivalence: 'file name' (Internal Whitespace) 98
ParentOf 49 Path Equivalence: 'filename/' (Trailing Slash) 99
ParentOf 50 Path Equivalence: '//multiple/leading/slash' 100
ParentOf 51 Path Equivalence: '/multiple//internal/slash' 102
ParentOf 52 Path Equivalence: '/multiple/trailing/slash//' 103
ParentOf 53 Path Equivalence: '\multiple\\internal\backslash' 104
ParentOf 54 Path Equivalence: 'filedir\' (Trailing Backslash) 105
ParentOf 55 Path Equivalence: '/./' (Single Dot Directory) 106
ParentOf 56 Path Equivalence: 'filedir*' (Wildcard) 107
ParentOf 57 Path Equivalence: 'fakedir/../realdir/filename' 108
ParentOf 58 Path Equivalence: Windows 8.3 Filename 110
PeerOf 1289 Improper Validation of Unsafe Equivalence in Input 2141
CanFollow 20 Improper Input Validation 20
CanFollow 73 External Control of File Name or Path 132
CanFollow 172 Encoding Error 433
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1219 File Handling Issues 2480
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Access Control
Read Files or Directories
Modify Files or Directories
Bypass Protection Mechanism
An attacker may be able to traverse the file system to
unintended locations and read or overwrite the contents
of unexpected files. If the files are used for a security
mechanism than an attacker may be able to bypass the
mechanism.
Detection Methods
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis
CWE Version 4.14
CWE-41: Improper Resolution of Path Equivalence
CWE-41: Improper Resolution of Path Equivalence