COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1023

Incomplete Comparison with Missing Factors

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Soyutlama

Class

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Alter Execution LogicBypass Protection Mechanism

Etkilenen güvenlik alanları: Integrity, Access Control

An incomplete comparison can lead to resultant weaknesses, e.g., by operating on the wrong object or making a security decision without considering a required factor.

Savunma

Nasıl önlenir ve çözülür?

  • Follow secure coding guidelines for input handling and boundary checking.
  • Enforce strict security reviews and automated static analysis (SAST) checks.

Doğrulama

Nasıl tespit edilir?

Manual Static Analysis

Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.