The wrong "handler" is assigned to process an object.
View on MITREAn example of deploying the wrong handler would be calling a servlet to reveal source code of a .JSP file, or automatically "determining" type of the object even if it is contradictory to an explicitly specified type.
Perform a type check before interpreting an object.
Reject any inconsistent types, such as a file with a .GIF extension that appears to consist of PHP code.
No detection method information available for this CWE.
Source code disclosure via manipulated file extension that causes parsing by wrong DLL.
View DetailsWeb browser does not properly handle the Content-Type header field, causing a different application to process the document.
View DetailsArbitrary Perl functions can be loaded by calling a non-existent function that activates a handler.
View DetailsNo relationship information available for this CWE.
CWE-430: Deployment of Wrong Handler is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The wrong "handler" is assigned to process an object. An example of deploying the wrong handler would be calling a servlet to reveal source code of a .JSP file, or automatically "determining" type of the object even if it is contradictory to an explicitly specified type.
If exploited, CWE-430 (Deployment of Wrong Handler) it can compromise Integrity and Other, leading to outcomes such as Varies by Context and Unexpected State.
Recommended mitigations for CWE-430 include: Perform a type check before interpreting an object. Reject any inconsistent types, such as a file with a .GIF extension that appears to consist of PHP code.
CWE-430 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-430, including CVE-2001-0004, CVE-2002-0025, CVE-2000-1052 and CVE-2002-1742. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-430 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.