CWE-86

Improper Neutralization of Invalid Characters in Identifiers in Web Pages

VariantDraft

Description

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Some web browsers may remove these sequences, resulting in output that may have unintended control implications. For example, the product may attempt to remove a "javascript:" URI scheme, but a "java%00script:" URI may bypass this check and still be rendered as active javascript by some browsers, allowing XSS or other attacks.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-247 · CAPEC-73 · CAPEC-85

CVEs mapped to this weakness (3)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-21864	Intel Arc & Iris Xe Graphics	Hig	0.51	7.8	0.00	May 16, 2024	Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.
CVE-2023-37908	Cryptpad Xwiki Rendering		0.00	—	0.01	Oct 25, 2023	XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via…
CVE-2023-31126	Cryptpad Xwiki Commons		0.00	—	0.01	May 9, 2023	`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability…

CVE-2024-21864HigMay 16, 2024
Intel
Arc & Iris Xe Graphics
risk 0.51cvss 7.8epss 0.00
Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.
CVE-2023-37908Oct 25, 2023
Cryptpad
Xwiki Rendering
risk 0.00cvss —epss 0.01
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via…
CVE-2023-31126May 9, 2023
Cryptpad
Xwiki Commons
risk 0.00cvss —epss 0.01
`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability…