CWE-692 Detail

CWE-692

Incomplete Denylist to Cross-Site Scripting
Draft
2008-04-11
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Notifiche per un CWE specifico
Rimani informato su qualsiasi modifica relativa a un CWE specifico.
Gestione notifiche

Nome: Incomplete Denylist to Cross-Site Scripting

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

CWE Description

While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.

General Informations

Modes Of Introduction

Implementation

Piattaforme applicabili

Linguaggio

Class: Not Language-Specific (Undetermined)

Tecnologie

Class: Web Based (Often)
Name: Web Server (Often)

Conseguenze comuni

Ambito Impatto Probabilità
Confidentiality
Integrity
Availability		Execute Unauthorized Code or Commands

Esempi osservati

Riferimenti Descrizione

CVE-2007-5727

Denylist only removes