CWE-692
Incomplete Denylist to Cross-Site Scripting
2008-04-11
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.
一般情報
導入モード
Implementation適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)テクノロジー
クラス： Web Based (Often)名前： Web Server (Often)
一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands 注記：Attackers could create XSS variants that still work. While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists. |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2007-5727 | Denylist only removes |