1533
Notes
Research Gap
Weaknesses related to this Pillar appear to be under-studied, especially with respect to
classification schemes. Input from academic and other communities could help identify and
resolve gaps or organizational difficulties within CWE.
Maintenance
This entry likely has some relationships with case sensitivity (CWE-178), but case sensitivity is a
factor in other types of weaknesses besides comparison. Also, in cryptography, certain attacks
are possible when certain comparison operations do not take place in constant time, causing a
timing-related information leak (CWE-208).
Related Attack Patterns
CAPEC-ID Attack Pattern Name
3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
6 Argument Injection
7 Blind SQL Injection
8 Buffer Overflow in an API Call
9 Buffer Overflow in Local Command-Line Utilities
10 Buffer Overflow via Environment Variables
14 Client-side Injection-induced Buffer Overflow
15 Command Delimiters
24 Filter Failure through Buffer Overflow
41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads
43 Exploiting Multiple Input Interpretation Layers
44 Overflow Binary Resource File
45 Buffer Overflow via Symbolic Links
46 Overflow Variables and Tags
47 Buffer Overflow via Parameter Expansion
52 Embedding NULL Bytes
53 Postfix, Null Terminate, and Backslash
64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
67 String Format Overflow in syslog()
71 Using Unicode Encoding to Bypass Validation Logic
73 User-Controlled Filename
78 Using Escaped Slashes in Alternate Encoding
79 Using Slashes in Alternate Encoding
80 Using UTF-8 Encoding to Bypass Validation Logic
88 OS Command Injection
92 Forced Integer Overflow
120 Double Encoding
182 Flash Injection
267 Leverage Alternate Encoding
CWE-698: Execution After Redirect (EAR)
Weakness ID : 698
Structure : Simple
Abstraction : Base
Description
The web application sends a redirect to another location, but instead of exiting, it executes
additional code.
CWE Version 4.14
CWE-698: Execution After Redirect (EAR)
CWE-698: Execution After Redirect (EAR)