1970
Scope Impact Likelihood
Unchecked input leads to cross-site scripting, process
control, and SQL injection vulnerabilities, among others.
Detection Methods
Automated Static Analysis
Some instances of improper input validation can be detected using automated static analysis. A
static analysis tool might allow the user to specify which application-specific methods or functions
perform input validation; the tool might also have built-in knowledge of validation frameworks
such as Struts. The tool may then suppress or de-prioritize any associated warnings. This allows
the analyst to focus on areas of the software in which input validation does not appear to be
present. Except in the cases described in the previous paragraph, automated static analysis
might not be able to recognize when proper input validation is being performed, leading to
false positives - i.e., warnings that do not have any security consequences or require any code
changes.
Potential Mitigations
Phase: Implementation
Properly use provided input validation frameworks.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
CWE-1174: ASP.NET Misconfiguration: Improper Model Validation
Weakness ID : 1174
Structure : Simple
Abstraction : Variant
Description
The ASP.NET application does not use, or incorrectly uses, the model validation framework.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1173 Improper Use of Validation Framework 1969
Weakness Ordinalities
Indirect :
Applicable Platforms
Language : ASP.NET (Prevalence = Undetermined)
CWE Version 4.14
CWE-1176: Inefficient CPU Computation
CWE-1176: Inefficient CPU Computation