COMMON WEAKNESS ENUMERATIONIncomplete

CWE-187

Partial String Comparison

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Soyutlama

Variant

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Genişletilmiş açıklama

For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Alter Execution LogicBypass Protection Mechanism

Etkilenen güvenlik alanları: Integrity, Access Control

Savunma

Nasıl önlenir ve çözülür?

Testing

Test ve doğrulama yaklaşımı

Detay
Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.