The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Allowed | B | 96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 990 | SFP Secondary Cluster: Tainted Input to Command |
| MemberOf | Prohibited | C | 1019 | Validate Inputs |
| MemberOf | Prohibited | C | 1347 | OWASP Top Ten 2021 Category A03:2021 - Injection |
| MemberOf | Prohibited | C | 1409 | Comprehensive Categorization: Injection |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-311 | Execute Unauthorized Code or Commands (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1019 | Validate Inputs |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1347 | OWASP Top Ten 2021 Category A03:2021 - Injection |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 990 | SFP Secondary Cluster: Tainted Input to Command |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrityAvailability | N/A | Execute Unauthorized Code or Commands | N/A |
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
| Reference | Description |
|---|
| Ordinality | Description |
|---|
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
This can be resultant from XSS/HTML injection because the same special characters can be involved. However, this is server-side code execution, not client-side.
N/A
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| PLOVER | N/A | N/A | Server-Side Includes (SSI) Injection |
| WASC | 36 | N/A | SSI Injection |