Weakness (CWE)
CWE-20: Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
How to prevent it (8 mitigations)
-
Architecture and Design
Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
-
Architecture and Design
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
-
Architecture and Design, Implementation
Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.
-
Implementation
When your application combines data from multiple sources, perform the validation after the sources have been combined. The individual data elements may pass the validation step but violate the intended restrictions after they have been combined.
-
Implementation
Be especially careful to validate all input when invoking code that crosses language boundaries, such as from an interpreted language to native code. This could create an unexpected interaction between the language boundaries. Ensure that you are not violating any of the expectations of the language with which you are interfacing. For example, even though Java may not be susceptible to buffer overflows, providing a large argument in a call to native code might trigger an overflow.
-
Implementation
Directly convert your input type into the expected data type, such as using a conversion function that translates a string into a number. After converting to the expected data type, ensure that the input's values fall within the expected range of allowable values and that multi-field consistencies are maintained.
Source: MITRE CWE-20
368 results · Clear filters · Feed
-
Medium 5.9CVE-2023-48223 Public exploit
fast-jwt JWT Algorithm Confusion
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match …
-
High 7.8CVE-2023-36407 Public exploit
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
-
High 7.5
Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
-
High 7.6
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.
-
High 7.6CVE-2023-5043 Public exploit
Ingress nginx annotation injection causes arbitrary command execution
Ingress nginx annotation injection causes arbitrary command execution.
-
Critical 10.0
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…
KEV Oct 5, 2023 -
Critical 9.9
Printer web page invalid command execution
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to…
-
Low 3.8
Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Ad…
-
High 7.5CVE-2023-4698 Public exploit
Improper Input Validation in usememos/memos
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
-
Critical 9.8
Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. I…
-
High 7.5
Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. If exploited, an unau…
-
High 8.8
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to …
-
High 8.8
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disru…
-
High 8.8
ASP.NET Elevation of Privilege Vulnerability
ASP.NET Elevation of Privilege Vulnerability
-
Medium 6.5CVE-2023-2728 Public exploit
Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the…
-
High 8.2
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege e…
-
Critical 9.8CVE-2023-34152 Public exploit
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob wi…
-
Critical 9.4
Remote Code injection in Barracuda Email Security Gateway
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar f…
KEV May 26, 2023 -
Critical 9.8
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
-
Critical 9.8
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).
-
High 8.1
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).
-
Critical 9.8
Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
KEV Mar 14, 2023 -
Medium 6.6CVE-2022-3294 Public exploit
Node address isn't always verified when proxying
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserv…
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
-
Medium 6.5CVE-2023-20009 Public exploit
A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and…
-
Medium 5.3CVE-2018-7935 Public exploit
There is a vulnerability in 21.328.01.00.00 version of the E5573Cs-322. Remote attackers could exploit this vulnerabili…
-
High 7.8CVE-2022-45770 Public exploit
Improper input validation in adgnetworkwfpdrv.sys in Adguard For Windows x86 through 7.11 allows local privilege escala…
-
Critical 9.8
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due…
KEV Jan 23, 2023 -
High 8.1
Netdata vulnerable to command injection
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the functi…
-
High 7.8CVE-2022-20470 Public exploit
In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch du…
-
High 8.1CVE-2022-24439 Public exploit
Remote Code Execution (RCE)
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because…
-
High 8.3
Remote Code execution in SnakeYAML
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…
-
Medium 5.4CVE-2022-39291 Public exploit
Denial of service through logs in zoneminder
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was …
-
Medium 6.5
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
-
Low 3.7CVE-2021-3754 Public exploit
Keycloak's improper input validation allows using email as username
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
-
High 8.8
Improper token validation leading to code execution in Teleport
Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a …
-
Unscored —CVE-2021-4204 Public exploit
An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. Thi…
-
Low 3.3CVE-2022-20338 Public exploit
In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input …
-
High 7.5
Moodle Arbitrary file read when importing lesson questions
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks.…
-
Critical 9.8CVE-2022-35649 Public exploit
Moodle PostScript Code Injection
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation…