CWE-83—Improper Neutralization of Script in Attributes in a Web Page

名称

Improper Neutralization of Script in Attributes in a Web Page

描述

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

常见后果

范围：

Confidentiality, Integrity, Availability

影响：

Read Application Data, Execute Unauthorized Code or Commands

相关 CWE

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')High