CWE-697: Incorrect Comparison
Description
The product compares two entities in a security-relevant context, but the comparison is incorrect.
This Pillar covers several possibilities: the comparison checks one factor incorrectly; the comparison should consider multiple factors, but it does not check at least one of those factors at all; the comparison checks the wrong factor.
- Abstraction
- PillarThe most abstract kind of weakness: a theme that groups classes.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Other
Varies by Context
When the comparison is incorrect, it may lead to resultant weaknesses.
Related weaknesses
Child weaknesses
- CWE-183Permissive List of Allowed Inputs
- CWE-185Incorrect Regular Expression
- CWE-581Object Model Violation: Just One of Equals and Hashcode Defined
- CWE-1023Incomplete Comparison with Missing Factors
- CWE-1024Comparison of Incompatible Types
- CWE-1025Comparison Using Wrong Factors
- CWE-1039Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
- CWE-1077Floating Point Comparison with Incorrect Operator
- CWE-1254Incorrect Comparison Logic Granularity
CAPEC attack patterns that exploit it
- CAPEC-3Using Leading 'Ghost' Character Sequences to Bypass Input Filters
- CAPEC-6Argument Injection
- CAPEC-7Blind SQL Injection
- CAPEC-8Buffer Overflow in an API Call
- CAPEC-9Buffer Overflow in Local Command-Line Utilities
- CAPEC-10Buffer Overflow via Environment Variables
- CAPEC-14Client-side Injection-induced Buffer Overflow
- CAPEC-15Command Delimiters
- CAPEC-24Filter Failure through Buffer Overflow
- CAPEC-41Using Meta-characters in E-mail Headers to Inject Malicious Payloads
- CAPEC-43Exploiting Multiple Input Interpretation Layers
- CAPEC-44Overflow Binary Resource File
- CAPEC-45Buffer Overflow via Symbolic Links
- CAPEC-46Overflow Variables and Tags
- CAPEC-47Buffer Overflow via Parameter Expansion
- CAPEC-52Embedding NULL Bytes
- CAPEC-53Postfix, Null Terminate, and Backslash
- CAPEC-64Using Slashes and URL Encoding Combined to Bypass Validation Logic
- CAPEC-67String Format Overflow in syslog()
- CAPEC-71Using Unicode Encoding to Bypass Validation Logic
- CAPEC-73User-Controlled Filename
- CAPEC-78Using Escaped Slashes in Alternate Encoding
- CAPEC-79Using Slashes in Alternate Encoding
- CAPEC-80Using UTF-8 Encoding to Bypass Validation Logic
- CAPEC-88OS Command Injection
- CAPEC-92Forced Integer Overflow
- CAPEC-120Double Encoding
- CAPEC-182Flash Injection
- CAPEC-267Leverage Alternate Encoding