Detalle CWE-692

CWE-692

Incomplete Denylist to Cross-Site Scripting
Draft
2008-04-11
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Notificaciones para un CWE
Manténgase informado sobre cualquier cambio en un CWE específico.
Gestionar notificaciones

Nombre: Incomplete Denylist to Cross-Site Scripting

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Descripción CWE

While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.

Informaciones generales

Modos de introducción

Implementation

Plataformas aplicables

Lenguaje

Class: Not Language-Specific (Undetermined)

Tecnologías

Class: Web Based (Often)
Name: Web Server (Often)

Consecuencias comunes

Alcance Impacto Probabilidad
Confidentiality
Integrity
Availability		Execute Unauthorized Code or Commands

Ejemplos observados

Referencias Descripción

CVE-2007-5727

Denylist only removes