CWE-187

Partial String Comparison
AI Translation Available

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Status
incomplete
Abstraction
variant

For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.

Common Consequences

integrity access control
Impacts
alter execution logic bypass protection mechanism

Potential Mitigations

Phases:
testing
Descriptions:
• Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.