1423
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Run arbitrary code.
Confidentiality Read Application Data
Attackers may be able to obtain sensitive information.
Potential Mitigations
Phase: Architecture and Design
Perform output validation in order to filter/escape/encode unsafe data that is being passed from
the server in an HTTP response header.
Phase: Architecture and Design
Disable script execution functionality in the clients' browser.
Demonstrative Examples
Example 1:
In the following Java example, user-controlled data is added to the HTTP headers and returned to
the client. Given that the data is not subject to neutralization, a malicious user may be able to inject
dangerous scripting tags that will lead to script execution in the client browser.
Example Language: Java (Bad)
response.addHeader(HEADER_NAME, untrustedRawInputData);
Observed Examples
Reference Description
CVE-2006-3918 Web server does not remove the Expect header from an HTTP request when
it is reflected back in an error message, allowing a Flash SWF file to perform
XSS attacks.
https://www.cve.org/CVERecord?id=CVE-2006-3918
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 725 OWASP Top Ten 2004 Category A4 - Cross-Site
Scripting (XSS) Flaws
711 2336
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP24 Tainted input to command
CWE-645: Overly Restrictive Account Lockout Mechanism
Weakness ID : 645
Structure : Simple
Abstraction : Base
CWE Version 4.14
CWE-645: Overly Restrictive Account Lockout Mechanism
CWE-645: Overly Restrictive Account Lockout Mechanism