CWE-692 Detalhe

CWE-692

Incomplete Denylist to Cross-Site Scripting
Draft
2008-04-11
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Notificações para um CWE
Fique informado sobre quaisquer alterações para um CWE específico.
Gerenciar notificações

Nome: Incomplete Denylist to Cross-Site Scripting

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Descrição CWE

While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.

Informações Gerais

Modos de Introdução

Implementation

Plataformas Aplicáveis

Linguagem

Class: Not Language-Specific (Undetermined)

Tecnologias

Class: Web Based (Often)
Name: Web Server (Often)

Consequências Comuns

Escopo Impacto Probabilidade
Confidentiality
Integrity
Availability		Execute Unauthorized Code or Commands

Exemplos Observados

Referências Descrição

CVE-2007-5727

Denylist only removes