CWEweakness
CWE-235 Improper Handling of Extra Parameters
- Abstraction
- Variant
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
Common consequences
• Integrity: Unexpected State
Observed examples
• CVE-2003-1014: MIE. multiple gateway/security products allow restriction bypass using multiple MIME fields with the same name, which are interpreted differently by clients.
Related
Attack pattern · CAPEC (1)
- CAPEC-460 HTTP Parameter Pollution (HPP) attack pattern
Observed example · CVE (1)
- CVE-2003-1014 Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use… vulnerability
Child of · CWE (1)
- CWE-233 Improper Handling of Parameters weakness
Referenced by CAPEC · weakness (1)
- CAPEC-460 HTTP Parameter Pollution (HPP) attack pattern
Referenced by CVE · weakness (4)
- CVE-2026-27851 When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too,… vulnerability
- CVE-2026-20083 A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with… vulnerability
- CVE-2024-47651 This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. vulnerability
- CVE-2017-20160 A vulnerability was found in flitto express-param up to 0.x. vulnerability