CWE-783: Operator Precedence Logic Error
Description
The product uses an expression in which operator precedence causes incorrect logic to be used.
While often just a bug, operator precedence logic errors can have serious consequences if they are used in security-critical code, such as making an authentication decision.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Low
- Status
- Draft
Common consequences
- ConfidentialityIntegrityAvailability
Varies by Context; Unexpected State
The consequences will vary based on the context surrounding the incorrect precedence. In a security decision, integrity or confidentiality are the most likely results. Otherwise, a crash may occur due to the software reaching an unexpected state.
Potential mitigations
- Implementation
Regularly wrap sub-expressions in parentheses, especially in security-critical code.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.