CWE-151
Improper Neutralization of Comment Delimiters
2006-07-19
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Improper Neutralization of Comment Delimiters
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.
Thông tin chung
Các cách xuất hiện
ImplementationNền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Integrity | Unexpected State |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2002-0001 | Mail client command execution due to improperly terminated comment in address list. |
CVE-2004-0162 | MIE. RFC822 comment fields may be processed as other fields by clients. |
CVE-2004-1686 | Well-placed comment bypasses security warning. |
CVE-2005-1909 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow ">!--" while denying most other tags. |
CVE-2005-1969 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow "
|
