CWE-187β€”Partial String Comparison

PUBLISHEDweakness record
released 2006-07-19 Β· last modified 2025-12-11

Metadata

CWE ID:
CWE-187
Abstraction:
Variant
Structure:
Simple
Status:
Incomplete
Release Date:
2006-07-19
Latest Modification Date:
2025-12-11

Weakness Name

Partial String Comparison

Description

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.

Common Consequences

Scope:
Integrity, Access Control
Impact:
Alter Execution Logic, Bypass Protection Mechanism

Related Weaknesses

browse all CWEs