The product uses an expression in which operator precedence causes incorrect logic to be used.

What CVEs are caused by CWE-783?

19 recorded CVEs are attributed to CWE-783, including CVE-2024-32896, CVE-2017-13322, CVE-2024-20480. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

How do you prevent CWE-783?

Regularly wrap sub-expressions in parentheses, especially in security-critical code.

How is CWE-783 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-783?

Exploiting CWE-783 can lead to: Varies by Context, Unexpected State.

Is CWE-783 actively exploited?

Yes. 1 CWE-783 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 19 recorded CVEs.

CWE-783: Operator Precedence Logic Error

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In the following example, the method validateUser makes a call to another method to authenticate a username and password for a user and returns a success or failure code.

Vulnerable example

#define FAIL 0

However, the method that authenticates the username and password is called within an if statement with incorrect operator precedence logic. Because the comparison operator "==" has a higher precedence than the assignment operator "=", the comparison operator will be evaluated first and if the method returns FAIL then the comparison will be true, the return variable will be set to true and SUCCESS will be returned. This operator precedence logic error can be easily resolved by properly using parentheses within the expression of the if statement, as shown below.

In this example, the method calculates the return on investment for an accounting/financial application. The return on investment is calculated by subtracting the initial investment costs from the current value and then dividing by the initial investment costs.

Vulnerable example

java

public double calculateReturnOnInvestment(double currentValue, double initialInvestment) {

CWE-783: Operator Precedence Logic Error

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-783

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-783