CWEweakness

CWE-351 Insufficient Type Distinction

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

Common consequences

• Other: Other

Observed examples

• CVE-2005-2260: Browser user interface does not distinguish between user-initiated and synthetic events. • CVE-2005-2801: Product does not compare all required data in two separate elements, causing it to think they are the same, leading to loss of ACLs. Similar to Same Name error.

Related

Observed example · CVE (2)

  • CVE-2005-2801 xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr… vulnerability
  • CVE-2005-2260 The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between… vulnerability

Child of · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

Peer of · CWE (1)

  • CWE-436 Interpretation Conflict weakness

Referenced by CVE · weakness (15)

  • CVE-2026-15305 Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes… vulnerability
  • CVE-2025-31951 HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. vulnerability
  • CVE-2026-41341 OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as… vulnerability
  • CVE-2025-65960 Contao is an Open Source CMS. vulnerability
  • CVE-2025-54412 skops is a Python library which helps users share and ship their scikit-learn based models. vulnerability
  • CVE-2025-54413 skops is a Python library which helps users share and ship their scikit-learn based models. vulnerability
  • CVE-2025-47939 TYPO3 is an open source, PHP based web content management system. vulnerability
  • CVE-2025-30510 An attacker can upload an arbitrary file instead of a plant image. vulnerability
  • CVE-2025-32035 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. vulnerability
  • CVE-2024-45676 IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user to upload insecure files, due to insufficient file type… vulnerability
  • CVE-2024-4769 When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and… vulnerability
  • CVE-2023-38831 RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. vulnerability
  • CVE-2023-2866 If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web… vulnerability
  • CVE-2022-1642 A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a… vulnerability
  • CVE-2020-10134 Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via… vulnerability

Referenced by CWE · peer of (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness