CWE-625: Permissive Regular Expression

ID CWE-625

Abstraction Base

Structure Simple

Status Draft

Number of CVEs 4

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include:

not identifying the beginning and end of the target string
using wildcards instead of acceptable character ranges
others

Modes of Introduction

Phase	Note
Implementation	This problem is frequently found when the regular expression is used in input validation or security features such as authentication.

Applicable Platforms

Type	Class	Name	Prevalence
Language		Perl
Language		PHP

Relationships

View			Weakness
# ID	View	Status	# ID	Name	Abstraction	Structure	Status
CWE-1000	Research Concepts	Draft	CWE-185	Incorrect Regular Expression	Class	Simple	Draft
CWE-1000	Research Concepts	Draft	CWE-187	Partial String Comparison	Variant	Simple	Incomplete
CWE-1000	Research Concepts	Draft	CWE-184	Incomplete List of Disallowed Inputs	Base	Simple	Draft
CWE-1000	Research Concepts	Draft	CWE-183	Permissive List of Allowed Inputs	Base	Simple	Draft

CVEs Published

Based on CVE published date

CVSS Severity

CVSS Severity - By Year

CVSS Base Score

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date