Compliance Node Overview
CWE-20 (Improper Input Validation) is one of the most foundational and broadly applicable software security weaknesses, ranked consistently near the top of the CWE Top 25. CWE-20 is defined as: the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. The Extended Description identifies two forms of input: raw data (strings, numbers, parameters, file contents) and metadata (information about the raw data such as headers or size). Properties requiring validation include specified quantities (size, length, frequency, price, rate, number of operations, time); well-formedness (syntactic correctness); specified or derived type (actual type or apparent type); consistency (between individual data elements, between raw data and metadata, between references); conformance to domain-specific rules (business logic); and authenticity, ownership, or other attestations (e.g., a cryptographic signature). Common Consequences include availability impact (attackers providing unexpected values can crash programs or cause excessive resource consumption of CPU or memory); confidentiality impact (attackers controlling resource references may read confidential data or access files); and integrity and availability impact (an attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution). The Potential Mitigations include attack-surface reduction via an accept-known-good input validation strategy using a list of acceptable inputs that strictly conform to specifications; assume all input is malicious; validate length, type, acceptable value ranges, missing or extra inputs, syntax, consistency, and business rule conformance; ensure all client-side security checks are duplicated on the server side; and canonicalize inputs to the application's current internal representation before validation. CWE-20 is the parent weakness for many specific injection and parsing weaknesses including CWE-78 (OS command injection), CWE-79 (XSS), CWE-89 (SQL injection), and CWE-22 (path traversal).
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/20.html
SHA-256 integrity: 708a20a768b1c7cf77d70a5bf72873ada14a4a7757596e7ec9c7966660bede69
Primary Citations — 9 traced to source
- CWE-20: Improper Input Validation - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/20.html
- CWE-20 Definition - the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly
+ 7 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access