CWE-692
Incomplete Denylist to Cross-Site Scripting
2008-04-11
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.
一般資訊
引入方式
Implementation適用平台
程式語言
類別： Not Language-Specific (Undetermined)技術
類別： Web Based (Often)名稱： Web Server (Often)
常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands 注意：Attackers could create XSS variants that still work. While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2007-5727 | Denylist only removes |