CWE-597

Use of Wrong Operator in String Comparison

VariantDraft

Description

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

In Java, using == or != to compare two strings for equality actually compares two objects for equality rather than their string values for equality. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, the unintended comparison result could be leveraged to affect program security.

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (3)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-36072	SilverwareGames Silverwaregames	Med	0.38	5.9	0.01	Sep 6, 2022	SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the `0e` symbols were being handled as zero multiplied with the `e` number.…
CVE-2021-4259	Phpredisadmin Project Phpredisadmin	Med	0.00	5.0	0.01	Dec 19, 2022	A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading…
CVE-2021-3797	Hestiacp Hestiacp	Cri	0.00	9.8	0.01	Sep 15, 2021	hestiacp is vulnerable to Use of Wrong Operator in String Comparison

CVE-2022-36072MedSep 6, 2022
SilverwareGames
Silverwaregames
risk 0.38cvss 5.9epss 0.01
SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the `0e` symbols were being handled as zero multiplied with the `e` number.…
CVE-2021-4259MedDec 19, 2022
Phpredisadmin Project
Phpredisadmin
risk 0.00cvss 5.0epss 0.01
A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading…
CVE-2021-3797CriSep 15, 2021
Hestiacp
Hestiacp
risk 0.00cvss 9.8epss 0.01
hestiacp is vulnerable to Use of Wrong Operator in String Comparison