CWE-692
Incomplete Denylist to Cross-Site Scripting
2008-04-11
00h00 +00:00
00h00 +00:00
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
이름: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.
일반 정보
취약점 도입 방식
Implementation적용 가능한 플랫폼
언어
클래스: Not Language-Specific (Undetermined)기술
클래스: Web Based (Often)이름: Web Server (Often)
일반적인 결과
| 범위 | 영향 | 가능성 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands 참고: Attackers could create XSS variants that still work. While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists. |
관찰된 예시
| 참고 자료 | 설명 |
|---|---|
CVE-2007-5727 | Denylist only removes |