CWE一覧に戻る
CWE-184

不許可入力の不完全なリスト

Incomplete List of Disallowed Inputs
脆弱性 レビュー中
JA

この製品は、ポリシーによって許可されない入力(または入力の特性)のリストに依存する保護メカニズムを実装しているか、そうでなければ、追加の処理が行われる前に中和するために他のアクションを必要とするが、そのリストは不完全である。

EN

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Scope: Access Control / Impact: Bypass Protection Mechanism
Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.
MITRE公式ページ — CWE-184