CWE-151
Improper Neutralization of Comment Delimiters
2006-07-19
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Improper Neutralization of Comment Delimiters
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.
一般資訊
引入方式
Implementation適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Integrity | Unexpected State |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2002-0001 | Mail client command execution due to improperly terminated comment in address list. |
CVE-2004-0162 | MIE. RFC822 comment fields may be processed as other fields by clients. |
CVE-2004-1686 | Well-placed comment bypasses security warning. |
CVE-2005-1909 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow ">!--" while denying most other tags. |
CVE-2005-1969 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow "
|
