The wrong "handler" is assigned to process an object.
An example of deploying the wrong handler would be calling a servlet to reveal source code of a .JSP file, or automatically "determining" type of the object even if it is contradictory to an explicitly specified type.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| CanPrecede | Allowed | V | 433 | Unparsed Raw Web Content Delivery |
| ChildOf | Discouraged | P | 691 | Insufficient Control Flow Management |
| ParentOf | Allowed | B | 434 | Unrestricted Upload of File with Dangerous Type |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 429 | Handler Errors |
| MemberOf | Prohibited | C | 977 | SFP Secondary Cluster: Design |
| MemberOf | Prohibited | C | 1348 | OWASP Top Ten 2021 Category A04:2021 - Insecure Design |
| MemberOf | Prohibited | C | 1410 | Comprehensive Categorization: Insufficient Control Flow Management |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-315 | Unexpected State (impact) |
| MemberOf | Prohibited | BS | BOSS-326 | Varies by Context (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1348 | OWASP Top Ten 2021 Category A04:2021 - Insecure Design |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 429 | Handler Errors |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 977 | SFP Secondary Cluster: Design |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| IntegrityOther | N/A | Varies by ContextUnexpected State | N/A |
Perform a type check before interpreting an object.
Reject any inconsistent types, such as a file with a .GIF extension that appears to consist of PHP code.
N/A
| Reference | Description |
|---|---|
| CVE-2001-0004 | Source code disclosure via manipulated file extension that causes parsing by wrong DLL. |
| CVE-2002-0025 | Web browser does not properly handle the Content-Type header field, causing a different application to process the document. |
| CVE-2000-1052 | Source code disclosure by directly invoking a servlet. |
| CVE-2002-1742 | Arbitrary Perl functions can be loaded by calling a non-existent function that activates a handler. |
| Ordinality | Description |
|---|---|
| Resultant | This weakness is usually resultant from other weaknesses. |
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| PLOVER | N/A | N/A | Improper Handler Deployment |