177
[REF-725]OWASP. "DOM based XSS Prevention Cheat Sheet". < http://www.owasp.org/index.php/
DOM_based_XSS_Prevention_Cheat_Sheet >.
[REF-726]Jason Lam. "Top 25 series - Rank 1 - Cross Site Scripting". 2010 February 2. SANS
Software Security Institute. < https://www.sans.org/blog/top-25-series-rank-1-cross-site-scripting/
>.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-956]Wikipedia. "Samy (computer worm)". < https://en.wikipedia.org/wiki/
Samy_(computer_worm) >.2018-01-16.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page
(Basic XSS)
Weakness ID : 80
Structure : Simple
Abstraction : Variant
Description
The product receives input from an upstream component, but it does not neutralize or incorrectly
neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting
elements when they are sent to a downstream component that processes web pages.
Extended Description
This may allow such characters to be treated as control characters, which are executed client-side
in the context of the user's session. Although this can be classified as an injection problem, the
more pertinent issue is the improper conversion of such special characters to respective contextappropriate
entities before displaying them to the user.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 79 Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')