217
Nature Type ID Name Page
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Maintenance
The description for this entry is generally applicable to XML, but the name includes "blind XPath
injection" which is more closely associated with CWE-643. Therefore this entry might need to be
deprecated or converted to a general category - although injection into raw XML is not covered
by CWE-643 or CWE-652.
Theoretical
In vulnerability theory terms, this is a representation-specific case of a Data/Directive Boundary
Error.
Research Gap
Under-reported. This is likely found regularly by third party code auditors, but there are very few
publicly reported examples.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER XML injection (aka Blind Xpath
injection)
OWASP Top Ten 2007 A2 CWE More Specific Injection Flaws
OWASP Top Ten 2004 A6 CWE More Specific Injection Flaws
WASC 23 XML Injection
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
83 XPath Injection
250 XML Injection
References
[REF-882]Amit Klein. "Blind XPath Injection". 2004 May 9. < https://dl.packetstormsecurity.net/
papers/bypass/Blind_XPath_Injection_20040518.pdf >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Weakness ID : 93
Structure : Simple
Abstraction : Base
Description
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or
records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')