460
Abstraction : Base
Description
The product implements a protection mechanism that relies on a list of inputs (or properties
of inputs) that are not allowed by policy or otherwise require other action to neutralize before
additional processing takes place, but the list is incomplete, leading to resultant weaknesses.
Extended Description
Developers often try to protect their products against malicious input by performing tests against
inputs that are known to be bad, such as special characters that can invoke new commands.
However, such lists often only account for the most well-known bad inputs. Attackers may be able
to find other malicious inputs that were not expected by the developer, allowing them to bypass the
intended protection mechanism.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1023 Incomplete Comparison with Missing Factors 1865
ChildOf 693 Protection Mechanism Failure 1520
ParentOf 692 Incomplete Denylist to Cross-Site Scripting 1519
PeerOf 86 Improper Neutralization of Invalid Characters in Identifiers in
Web Pages