262
Nature Type ID Name Page
ChildOf 1173 Improper Use of Validation Framework 1969
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Other
If an action form mapping does not have a validation form
defined, it may be vulnerable to a number of attacks that
rely on unchecked input. Unchecked input is the root cause
of some of today's worst and most common software
security problems. Cross-site scripting, SQL injection, and
process control vulnerabilities all stem from incomplete or
absent input validation.
Confidentiality
Integrity
Availability
Other
Other
Although J2EE applications are not generally susceptible
to memory corruption attacks, if a J2EE application
interfaces with native code that does not perform array
bounds checking, an attacker may be able to use an input
validation mistake in the J2EE application to launch a
buffer overflow attack.
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Map every Action Form to a corresponding validation form. An action or a form may perform
validation in other ways, but the Struts Validator provides an excellent way to verify that all
input receives at least a basic level of validation. Without this approach, it is difficult, and often
impossible, to establish with a high level of confidence that all input is validated.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Struts: Unvalidated Action Form
Software Fault Patterns SFP24 Tainted input to command
References
CWE Version 4.14
CWE-109: Struts: Validator Turned Off
CWE-109: Struts: Validator Turned Off