CWE-597: Use of Wrong Operator in String Comparison
ID
CWE-597
Abstraction
Variant
Structure
Simple
Status
Draft
Number of CVEs
3
The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
In Java, using == or != to compare two strings for equality actually compares two objects for equality rather than their string values for equality. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, the unintended comparison result could be leveraged to affect program security.
Modes of Introduction
| Phase | Note |
|---|---|
| Implementation |
Relationships
| View | Weakness | |||||||
|---|---|---|---|---|---|---|---|---|
| # ID | View | Status | # ID | Name | Abstraction | Structure | Status | |
| CWE-1000 | Research Concepts | Draft | CWE-595 | Comparison of Object References Instead of Object Contents | Variant | Simple | Incomplete | |
| CWE-1305 | CISQ Quality Measures (2020) | Incomplete | CWE-595 | Comparison of Object References Instead of Object Contents | Variant | Simple | Incomplete | |
| CWE-1000 | Research Concepts | Draft | CWE-480 | Use of Incorrect Operator | Base | Simple | Draft | |
CVEs Published
CVSS Severity
CVSS Severity - By Year
CVSS Base Score
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
|---|---|---|---|---|---|---|---|---|---|---|---|
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |
Loading...