1487
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Read Application Data
Execute Unauthorized Code or Commands
Potential Mitigations
Phase: Implementation
Resolve all filtered input to absolute or canonical representations before processing.
Phase: Implementation
Carefully check each input parameter against a rigorous positive specification (allowlist) defining
the specific characters and format allowed. All input should be neutralized, not just parameters
that the user is supposed to specify, but all data in the request, including tag attributes, hidden
fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing
XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site.
We often encounter data from the request that is reflected by the application server or the
CWE Version 4.14
CWE-85: Doubled Character XSS Manipulations
CWE-85: Doubled Character XSS Manipulations