COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1023

Incomplete Comparison with Missing Factors

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Abstraction

Class

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Alter Execution LogicBypass Protection Mechanism

Affected security scopes: Integrity, Access Control

An incomplete comparison can lead to resultant weaknesses, e.g., by operating on the wrong object or making a security decision without considering a required factor.

Defence

How is it prevented and fixed?

  • Follow secure coding guidelines for input handling and boundary checking.
  • Enforce strict security reviews and automated static analysis (SAST) checks.

Verification

How is it detected?

Manual Static Analysis

Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
CWE-1023: Common Weakness Enumeration Entry CWE-1023 · DayBreach Sözlük · DayBreach