256
</var>
</field>
<field property="phone" depends="required,mask">
<arg position="0" key="prompt.phone"/>
<var>
<var-name>mask</var-name>
<var-value>^([0-9]{3})(-)([0-9]{4}|[0-9]{4})$</var-value>
</var>
</field>
<field property="email" depends="required,email">
<arg position="0" key="prompt.email"/>
</field>
</form>
</formset>
</form-validation>
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Struts: Form Field Without Validator
Software Fault Patterns SFP24 Tainted input to command
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-106: Struts: Plug-in Framework not in Use
Weakness ID : 106
Structure : Simple
Abstraction : Variant
Description
When an application does not use an input validation framework such as the Struts Validator, there
is a greater risk of introducing weaknesses related to insufficient input validation.
Extended Description
Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads
to cross-site scripting, process control, and SQL injection vulnerabilities, among others.
Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE
application interfaces with native code that does not perform array bounds checking, an attacker
may be able to use an input validation mistake in the J2EE application to launch a buffer overflow
attack.
CWE Version 4.14
CWE-106: Struts: Plug-in Framework not in Use
CWE-106: Struts: Plug-in Framework not in Use