533
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1016 Limit Exposure 2431
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Potential Mitigations
Phase: Architecture and Design
Phase: System Configuration
Recommendations include designing and adding consistent error handling mechanisms which
are capable of handling any user input to your web application, providing meaningful detail to
end-users, and preventing error messages that might provide information useful to an attacker
from being displayed.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and
Canonicalization
Weakness ID : 551
Structure : Simple
Abstraction : Base
Description
If a web server does not fully parse requested URLs before it examines them for authorization, it
may be possible for an attacker to bypass authorization protection.
Extended Description
For instance, the character strings /./ and / both mean current directory. If /SomeDirectory is a
protected directory and an attacker requests /./SomeDirectory, the attacker may be able to gain
access to the resource if /./ is not converted to / before the authorization check is performed.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-552: Files or Directories Accessible to External Parties
CWE-552: Files or Directories Accessible to External Parties