VulnScan

CWE-436: Interpretation Conflict

What is CWE-436?

MITRE CWE

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Verify to analyze this CWE entry

A short verification protects the official data source and prevents automated AI abuse.

Official definition

MITRE CWE

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

Detailed description

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Characteristics

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Modes of introduction

  • Architecture and Design
  • Implementation

Common consequences

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

  • Integrity, Other

    Unexpected State, Varies by Context

Mitigations

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Detection methods

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Representative vulnerabilities

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

These examples illustrate this CWE entry and are not an exhaustive list of related vulnerabilities.

  • CVE-2005-1215Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.
  • CVE-2002-0485Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
  • CVE-2002-1978FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
  • CVE-2002-1979FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
  • CVE-2002-0637Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.
  • CVE-2002-1777AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field).
  • CVE-2005-3310CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images.
  • CVE-2005-4260Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which is treated as ">" by many web browsers.
  • CVE-2005-4080Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags.

Sources and references

References

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan
CyStack VulnScan dashboard