An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.
This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.
| Nature | Mapping | Type | ID | Name |
|---|
| Nature | Mapping | Type | ID | Name |
|---|
| Nature | Mapping | Type | ID | Name |
|---|
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrityAvailability | N/A | Execute Unauthorized Code or Commands | N/A |
During development, do not mark it as safe for scripting.
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.
N/A
N/A
| Reference | Description |
|---|---|
| CVE-2007-0617 | control allows attackers to add malicious email addresses to bypass spam limits |
| CVE-2007-0219 | web browser uses certain COM objects as ActiveX |
| CVE-2006-6510 | kiosk allows bypass to read files |
| Ordinality | Description |
|---|---|
| Primary | N/A |
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|
| ID | Name |
|---|