Partial String Comparison
CWE-187
The product performs a string comparison that only examines a portion of the string before determining whether there is a match.
We track 11 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4.
How this weakness is prevented
- Testing: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Latest Partial String Comparison vulnerabilities
- 9.8 Critical severity
HiRDB Server Version 10: Partial String Comparison
Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; Hi
- 8.0 High severity
Fabric OS: Partial String Comparison
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restric
- 7.5 High severity
Red Hat Enterprise Linux 10: Partial String Comparison
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An atta
- 8.6 High severity
http-proxy-middleware is node.js http-proxy middleware.
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring mat
- 7.5 High severity
view_component: Partial String Comparison
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved pat
- 8.8 High severity
Jellyfin is an open source self hosted media server.
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extens
- 7.5 High severity
rack: Partial String Comparison
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it match
- 7.8 High severity
openwrt: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially le
- 9.9 Critical severity
moby: Partial String Comparison
Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances.
- 9.8 Critical severity
MQ Operator: Incorrect Comparison
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.
- 7.5 High severity
CODESYS Gateway Server V2: Partial String Comparison
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding p