VariantDraft
CWE-104Struts: Form Bean Does Not Extend Validation Class
Category: other
Description
If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
Common consequences· 2
- Other — OtherBypassing the validation framework for a form exposes the application to numerous types of attacks. Unchecked input is an important component of vulnerabilities like cross-site scripting, process control, and SQL injection.
- Confidentiality / Integrity / Availability / Other — OtherAlthough J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
Potential mitigations· 1
- [Implementation]Ensure that all forms extend one of the Validation Classes.
References
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.