1059
Reference Description
CVE-2002-1777 AV product detection bypass using inconsistency manipulation (file extension
in MIME Content-Type vs. Content-Disposition field).
https://www.cve.org/CVERecord?id=CVE-2002-1777
CVE-2005-3310 CMS system allows uploads of files with GIF/JPG extensions, but if they
contain HTML, Internet Explorer renders them as HTML instead of images.
https://www.cve.org/CVERecord?id=CVE-2005-3310
CVE-2005-4260 Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which
is treated as ">" by many web browsers.
https://www.cve.org/CVERecord?id=CVE-2005-4260
CVE-2005-4080 Interpretation conflict (non-standard behavior) enables XSS because browser
ignores invalid characters in the middle of tags.
https://www.cve.org/CVERecord?id=CVE-2005-4080
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 957 SFP Secondary Cluster: Protocol Error 888 2398
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1398 Comprehensive Categorization: Component Interaction 1400 2524
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Multiple Interpretation Error (MIE)
WASC 27 HTTP Response Smuggling
Related Attack Patterns
CAPEC-ID Attack Pattern Name
34 HTTP Response Splitting
105 HTTP Request Splitting
273 HTTP Response Smuggling
References
[REF-427]Steve Christey. "On Interpretation Conflict Vulnerabilities". Bugtraq. 2005 November 3. <
https://seclists.org/bugtraq/2005/Nov/30 >.2023-04-07.
[REF-428]Thomas H. Ptacek and Timothy N. Newsham. "Insertion, Evasion, and Denial of
Service: Eluding Network Intrusion Detection". 1998 January. < https://insecure.org/stf/secnet_ids/
secnet_ids.pdf >.2023-04-07.
[REF-429]Brett Moore. "0x00 vs ASP file upload scripts". 2004 July 3. < http://www.securityassessment.
com/Whitepapers/0x00_vs_ASP_File_Uploads.pdf >.
[REF-430]Rain Forest Puppy. "Poison NULL byte". Phrack.
[REF-431]David F. Skoll. "Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047
encoding". Bugtraq. 2004 September 5. < http://marc.info/?l=bugtraq&m=109525864717484&w=2
>.
CWE-437: Incomplete Model of Endpoint Features
Weakness ID : 437
Structure : Simple
CWE Version 4.14
CWE-437: Incomplete Model of Endpoint Features
CWE-437: Incomplete Model of Endpoint Features