CWE-187: Partial String Comparison
Description
The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- IntegrityAccess Control
Alter Execution Logic; Bypass Protection Mechanism
Potential mitigations
- Testing
Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.