CWE-58 MITRE 定义 ↗

CWE-58：Path Equivalence: Windows 8.3 Filename

概览

CWE-58（Path Equivalence: Windows 8.3 Filename）描述一种在漏洞数据库与安全评估中使用的弱点类型；定义、背景与映射 CVE 见下方各节。

安全影响
安全影响：因产品与场景而异；请结合 CVE 记录、严重度评分与 MITRE 说明进行优先级判断。

描述

The product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short "8.3" filename.

背景详情

来自 CWE 目录的扩展上下文（由 MITRE XHTML 渲染）。

On later Windows operating systems, a file can have a "long name" and a short name that is compatible with older Windows file systems, with up to 8 characters in the filename and 3 characters for the extension. These "8.3" filenames, therefore, act as an alternate name for files with long names, so they are useful pathname equivalence manipulations.

适用平台

类型 名称 类 普遍性 OS / CPE
language — Not Language-Specific Undetermined —
operating_system — Windows Undetermined —
technology — Not Technology-Specific Undetermined —

曾用名

  • Path Issue - Windows 8.3 Filename (2008-04-11)

内容提交

名称
PLOVER
日期
2006-07-19
版本
Draft 3

内容修订

日期 名称 版本 重要性 评论
2008-07-01 Eric Dalci 1.0 — updated Time_of_Introduction
2008-09-08 CWE Content Team 1.0 — updated Applicable_Platforms, Relationships, Taxonomy_Mappings
2008-10-14 CWE Content Team 1.0.1 — updated Description
2011-06-01 CWE Content Team 1.13 — updated Common_Consequences
2012-05-11 CWE Content Team 2.2 — updated References, Relationships
2012-10-30 CWE Content Team 2.3 — updated Potential_Mitigations
2014-07-30 CWE Content Team 2.8 — updated Relationships, Taxonomy_Mappings
2017-11-08 CWE Content Team 3.0 — updated Applicable_Platforms, References
2018-03-27 CWE Content Team 3.1 — updated References
2020-02-24 CWE Content Team 4.0 — updated Relationships
2023-01-31 CWE Content Team 4.10 — updated Description
2023-04-27 CWE Content Team 4.11 — updated Relationships
2023-06-29 CWE Content Team 4.12 — updated Mapping_Notes
2025-09-09 CWE Content Team 4.18 — updated Affected_Resources
2025-12-11 CWE Content Team 4.19 — updated Applicable_Platforms, Background_Details, Description, Weakness_Ordinalities
cvelogic Threat Intelligence