185
also being used by the downstream component. The problem of inconsistent output encodings
often arises in web pages. If an encoding is not specified in an HTTP header, web browsers
often guess about which encoding is being used. This can open up the browser to subtle XSS
attacks.
Phase: Implementation
With Struts, write all data from form beans with the bean's filter attribute set to true.
Phase: Implementation
Strategy = Attack Surface Reduction
To help mitigate XSS attacks against the user's session cookie, set the session cookie to be
HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet
Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible
to malicious client-side scripts that use document.cookie. This is not a complete solution, since
HttpOnly is not supported by all browsers. More importantly, XMLHTTPRequest and other
powerful browser technologies provide read access to HTTP headers, including the Set-Cookie
header in which the HttpOnly flag is set.
Effectiveness = Defense in Depth
Observed Examples
Reference Description
CVE-2001-0520 Bypass filtering of SCRIPT tags using onload in BODY, href in A, BUTTON,
INPUT, and others.
https://www.cve.org/CVERecord?id=CVE-2001-0520
CVE-2002-1493 guestbook XSS in STYLE or IMG SRC attributes.
https://www.cve.org/CVERecord?id=CVE-2002-1493
CVE-2002-1965 Javascript in onerror attribute of IMG tag.
https://www.cve.org/CVERecord?id=CVE-2002-1965
CVE-2002-1495 XSS in web-based email product via onmouseover event.
https://www.cve.org/CVERecord?id=CVE-2002-1495
CVE-2002-1681 XSS via script in <P> tag.
https://www.cve.org/CVERecord?id=CVE-2002-1681
CVE-2004-1935 Onload, onmouseover, and other events in an e-mail attachment.
https://www.cve.org/CVERecord?id=CVE-2004-1935
CVE-2005-0945 Onmouseover and onload events in img, link, and mail tags.
https://www.cve.org/CVERecord?id=CVE-2005-0945
CVE-2003-1136 Javascript in onmouseover attribute in e-mail address or URL.
https://www.cve.org/CVERecord?id=CVE-2003-1136
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER XSS using Script in Attributes
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CWE Version 4.14
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page