Read Time:48 Second
Description
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Modes of Introduction:
– Implementation
Related Weaknesses
Consequences
Other: Varies by Context
Potential Mitigations
Phase: Implementation
Effectiveness: High
Description:
CVE References
- CVE-2005-0269
- File extension check in forum software only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters.
- CVE-2001-1238
- Task Manager does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the Process tab which could allow local users to install Trojan horses that cannot be stopped.
- CVE-2004-2214
- HTTP server allows bypass of access restrictions using URIs with mixed case.