1857
[REF-5]Microsoft. "Mitigating Cross-site Scripting With HTTP-only Cookies". < https://
learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN
>.2023-04-07.
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User
Weakness ID : 1007
Structure : Simple
Abstraction : Base
Description
The product displays information or identifiers to a user, but the display mechanism does not make
it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which
may cause the user to misinterpret a glyph and perform an unintended, insecure action.
Extended Description
Some glyphs, pictures, or icons can be semantically distinct to a program, while appearing very
similar or identical to a human user. These are referred to as homoglyphs. For example, the
lowercase "l" (ell) and uppercase "I" (eye) have different character codes, but these characters
can be displayed in exactly the same way to a user, depending on the font. This can also occur
between different character sets. For example, the Latin capital letter "A" and the Greek capital
letter "#" (Alpha) are treated as distinct by programs, but may be displayed in exactly the same way
to a user. Accent marks may also cause letters to appear very similar, such as the Latin capital
letter grave mark "À" and its equivalent "Á" with the acute accent.
Adversaries can exploit this visual similarity for attacks such as phishing, e.g. by providing a link
to an attacker-controlled hostname that looks like a hostname that the victim trusts. In a different
use of homoglyphs, an adversary may create a back door username that is visually similar to the
username of a regular user, which then makes it more difficult for a system administrator to detect
the malicious username while reviewing logs.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 451 User Interface (UI) Misrepresentation of Critical Information 1079
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 355 User Interface Security Issues 2320
Weakness Ordinalities
Resultant :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Based (Prevalence = Sometimes)
Alternate Terms
CWE Version 4.14
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User