CWE

Improper Handling of Extra Parameters

ID: 235		Date: (C)2012-05-14   (M)2022-10-10
Type: weakness		Status: DRAFT
Abstraction Type: Base

Description

The software does not handle or incorrectly handles when a particular parameter, field, or argument name is specified two or more times.

Applicable Platforms
Language Class: All

Time Of Introduction

• Architecture and Design
• Implementation

Related Attack Patterns

• CAPEC-460

Common Consequences

Scope	Technical Impact	Notes
Integrity	Unexpected state

Detection Methods
None

Potential Mitigations
None

Relationships
This type of problem has a big role in multiple interpretation vulnerabilities and various HTTP attacks.

Related CWE	Type	View	Chain
CWE-235 ChildOf CWE-896	Category	CWE-888

Demonstrative Examples
None

Observed Examples

1. CVE-2003-1014 : MIE. multiple gateway/security products allow restriction bypass using multiple MIME fields with the same name, which are interpreted differently by clients.

For more examples, refer to CVE relations in the bottom box.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

Taxynomy	Id	Name	Fit
PLOVER		Extra Parameter Error

References:
None