CWE-184Incomplete List of Disallowed Inputs

Description

Common consequences· 1

• Access Control — Bypass Protection Mechanism
  Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.

Potential mitigations· 1

• [Implementation]Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Related CAPEC attack patterns· 9

Exploits (incoming)9

(incoming)27

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.