日本語

CWE-623 詳細

CWE-623

Unsafe ActiveX Control Marked Safe For Scripting
2007-05-07
00h00 +00:00
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Unsafe ActiveX Control Marked Safe For Scripting

The product includes an ActiveX control that is intended for restricted use, but the control has been marked as safe-for-scripting.

一般情報

導入モード

Architecture and Design
Implementation

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

テクノロジー

クラス： Web Based (Undetermined)

一般的な結果

スコープ 影響 可能性
Confidentiality
Integrity
Availability		Execute Unauthorized Code or Commands

注記：Attackers may be able to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

観察された例

参考文献 説明

CVE-2007-0617

control allows attackers to add malicious email addresses to bypass spam limits

CVE-2007-0219

web browser uses certain COM objects as ActiveX

CVE-2006-6510

kiosk allows bypass to read files

潜在的な緩和策

Phases : Architecture and Design
During development, do not mark it as safe for scripting.
Phases : System Configuration
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.

脆弱性マッピングノート

理由 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

参考文献

REF-503

Developing Secure ActiveX Controls
Microsoft.
https://learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN

REF-510

How to stop an ActiveX control from running in Internet Explorer
Microsoft.
https://support.microsoft.com/en-us/help/240797/how-to-stop-an-activex-control-from-running-in-internet-explorer

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

登録情報

名前 組織 日付 リリース日 Version
CWE Content Team MITRE 2007-05-07 +00:00 2007-05-07 +00:00 Draft 6

変更履歴

名前 組織 日付 コメント
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Description, Relationships, Observed_Example, Weakness_Ordinalities
CWE Content Team MITRE 2010-02-16 +00:00 updated References
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated References, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated References
CWE Content Team MITRE 2018-03-27 +00:00 updated References
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Observed_Examples
CWE Content Team MITRE 2022-04-28 +00:00 updated Research_Gaps
CWE Content Team MITRE 2023-01-31 +00:00 updated Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Applicable_Platforms
CWE Content Team MITRE 2026-10-28 +00:00 updated Common_Consequences, Description
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。