215
Factors: resultant to special character mismanagement, MAID, or denylist/allowlist problems.
Can be primary to authentication and verification errors.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER LDAP injection
OWASP Top Ten 2007 A2 CWE More Specific Injection Flaws
WASC 29 LDAP Injection
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
136 LDAP Injection
References
[REF-879]SPI Dynamics. "Web Applications and LDAP Injection".
CWE-91: XML Injection (aka Blind XPath Injection)
Weakness ID : 91
Structure : Simple
Abstraction : Base
Description
The product does not properly neutralize special elements that are used in XML, allowing attackers
to modify the syntax, content, or commands of the XML before it is processed by an end system.
Extended Description
Within XML, special elements could include reserved words or characters such as "<", ">", """, and
"&", which could then be used to add new data or modify XML syntax.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 74 Improper Neutralization of Special Elements in Output Used
by a Downstream Component ('Injection')