CWE-692
Incomplete Denylist to Cross-Site Scripting
2008-04-11
00h00 +00:00
00h00 +00:00
指定 CWE 通知
随时了解指定 CWE 的变更。
名称: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.
基本信息
引入方式
Implementation适用平台
编程语言
类： Not Language-Specific (Undetermined)技术
类： Web Based (Often)名称： Web Server (Often)
常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands 注意： Attackers could create XSS variants that still work. While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists. |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2007-5727 | Denylist only removes |