Weakness (CWE)
CWE-187: Partial String Comparison
The product performs a string comparison that only examines a portion of the string before determining whether there is a match.
How to prevent it (1 mitigation)
-
Testing
Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Source: MITRE CWE-187
10 results · Clear filters · Feed
-
Medium 5.9
SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex characte…
-
Medium 5.9
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fa…
-
Medium 6.5
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensiti…
-
Medium 5.8
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A…
-
Medium 6.3
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" res…
-
Medium 6.5
Windows HTTP Protocol Stack Tampering Vulnerability
Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network.
-
Medium 5.3
666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string co…
-
Medium 5.4
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted…
-
Medium 6.9
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring ma…
-
Medium 5.9
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved pa…