1389
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP27 Tainted input to environment
CWE-623: Unsafe ActiveX Control Marked Safe For Scripting
Weakness ID : 623
Structure : Simple
Abstraction : Variant
Description
An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.
Extended Description
This might allow attackers to use dangerous functionality via a web page that accesses the control,
which can lead to different resultant vulnerabilities, depending on the control's behavior.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 267 Privilege Defined With Unsafe Actions 641
PeerOf 618 Exposed Unsafe ActiveX Method 1380
Weakness Ordinalities
Primary :
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
Potential Mitigations
Phase: Architecture and Design
During development, do not mark it as safe for scripting.
Phase: System Configuration
After distribution, you can set the kill bit for the control so that it is not accessible from Internet
Explorer.
Observed Examples
Reference Description
CVE-2007-0617 control allows attackers to add malicious email addresses to bypass spam
limits
https://www.cve.org/CVERecord?id=CVE-2007-0617
CVE-2007-0219 web browser uses certain COM objects as ActiveX
https://www.cve.org/CVERecord?id=CVE-2007-0219
CVE-2006-6510 kiosk allows bypass to read files
https://www.cve.org/CVERecord?id=CVE-2006-6510
MemberOf Relationships
CWE Version 4.14
CWE-624: Executable Regular Expression Error
CWE-624: Executable Regular Expression Error