Weakness (CWE)
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Variant Draft
The product validates input before it is canonicalized.
How to prevent it (1 mitigation)
-
Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Source: MITRE CWE-180
4 results · Clear filters · Feed
-
Low 3.7
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common config…
-
Low 3.5
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforce…
-
Low 2.1
Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex) val…
-
Low 2.9
The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improper…