CWE-80—Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

名称

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

描述

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

常见后果

范围：

Confidentiality, Integrity, Availability

影响：

Read Application Data, Execute Unauthorized Code or Commands

注释：

An attacker could insert special characters that are processed client-side in the context of the user's session.

相关 CWE

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')High