CWE-436: Interpretation Conflict
Description
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- IntegrityOther
Unexpected State; Varies by Context
Related weaknesses
Child weaknesses
- CWE-86Improper Neutralization of Invalid Characters in Identifiers in Web Pages
- CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
- CWE-115Misinterpretation of Input
- CWE-437Incomplete Model of Endpoint Features
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CWE-626Null Byte Interaction Error (Poison Null Byte)
- CWE-650Trusting HTTP Permission Methods on the Server Side