CWE-1289
Improper Validation of Unsafe Equivalence in Input
2020-02-24
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Improper Validation of Unsafe Equivalence in Input
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
一般資訊
引入方式
Implementation適用平台
程式語言
類別： Not Language-Specific (Often)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Other | Varies by Context, Bypass Protection Mechanism 注意：Attackers can sometimes bypass input validation schemes by finding inputs that appear to be safe, but will be dangerous when processed at a lower layer or by a downstream component. For example, a simple XSS protection mechanism might try to validate that an input has no " |