CWE-76 - Improper Neutralization of Equivalent Special Elements
- Abstraction:Base
- Structure:Simple
- Status:Draft
- Release Date:2006-07-19
- Latest Modification Date:2023-06-29
Weakness Name
Improper Neutralization of Equivalent Special Elements
Description
The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
The product may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the product may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the product might filter a dangerous "-e" command-line switch when calling an external program, but it might not account for "--exec" or other switches that have the same semantics.
Common Consequences
Scope: Other
Impact: Other
Related Weaknesses
CWE-75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)