CWE-830
Inclusion of Web Functionality from an Untrusted Source
2010-12-13
00h00 +00:00
00h00 +00:00
指定 CWE 通知
随时了解指定 CWE 的变更。
名称: Inclusion of Web Functionality from an Untrusted Source
The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
基本信息
引入方式
ArrayImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
适用平台
编程语言
类： Not Language-Specific (Undetermined)技术
类： Web Based (Undetermined)名称： Web Server (Undetermined)
常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands |
漏洞映射说明
依据 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
参考资料
REF-778
Third-Party Web Widget Security FAQJeremiah Grossman.
https://blog.jeremiahgrossman.com/2010/07/third-party-web-widget-security-faq.html
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 1.11 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Type | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction |
