175
Nature Type ID Name Page
MemberOf 801 2010 Top 25 - Insecure Interaction Between
Components
800 2354
MemberOf 811 OWASP Top Ten 2010 Category A2 - Cross-Site
Scripting (XSS)
809 2357
MemberOf 864 2011 Top 25 - Insecure Interaction Between
Components
900 2371
MemberOf 884 CWE Cross-section 884 2567
MemberOf 931 OWASP Top Ten 2013 Category A3 - Cross-Site
Scripting (XSS)
928 2390
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1005 7PK - Input Validation and Representation 700 2421
MemberOf 1033 OWASP Top Ten 2017 Category A7 - Cross-Site
Scripting (XSS)
1026 2438
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Relationship
There can be a close relationship between XSS and CSRF (CWE-352). An attacker might use
CSRF in order to trick the victim into submitting requests to the server in which the requests
contain an XSS payload. A well-known example of this was the Samy worm on MySpace
[REF-956]. The worm used XSS to insert malicious HTML sequences into a user's profile and
add the attacker as a MySpace friend. MySpace friends of that victim would then execute the
payload to modify their own profiles, causing the worm to propagate exponentially. Since the
victims did not intentionally insert the malicious script themselves, CSRF was a root cause.
Applicable Platform
XSS flaws are very common in web applications, since they require a great deal of developer
discipline to avoid them.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Cross-site scripting (XSS)
7 Pernicious Kingdoms Cross-site Scripting
CLASP Cross-site scripting
OWASP Top Ten 2007 A1 Exact Cross Site Scripting (XSS)
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
OWASP Top Ten 2004 A4 Exact Cross-Site Scripting (XSS) Flaws
WASC 8 Cross-site Scripting
CWE Version 4.14
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79: Improper Neutralization of Input During
Web Page Generation ('Cross-site Scripting') 176
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP24 Tainted input to command
OMG ASCSM ASCSMCWE-