CWE-57—Path Equivalence: 'fakedir/../realdir/filename'

名称

Path Equivalence: 'fakedir/../realdir/filename'

描述

The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

常见后果

范围：

Confidentiality, Integrity

影响：

Read Files or Directories, Modify Files or Directories

相关 CWE

• CWE-41Improper Resolution of Path Equivalence