CWE-151
Improper Neutralization of Comment Delimiters
2006-07-19
00h00 +00:00
00h00 +00:00
指定 CWE 通知
随时了解指定 CWE 的变更。
名称: Improper Neutralization of Comment Delimiters
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.
基本信息
引入方式
Implementation适用平台
编程语言
类： Not Language-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Integrity | Unexpected State |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2002-0001 | Mail client command execution due to improperly terminated comment in address list. |
CVE-2004-0162 | MIE. RFC822 comment fields may be processed as other fields by clients. |
CVE-2004-1686 | Well-placed comment bypasses security warning. |
CVE-2005-1909 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow ">!--" while denying most other tags. |
CVE-2005-1969 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow "
|
