9. of Denial of Service
An attacker can make a client unavailable or unusable without ever authenticating, and the problem persists after the attacker goes away (client, anonymous, persistent).
|
Threat |
|
|
|
You are not sanitizing untrusted input before writing it to your database, and as a consequence, an attacker has managed to store a DOM-based cross-site scripting (XSS) attack in your database that causes an infinite loop or recursion in the JavaScript on your site, causing your clients’ CPUs to max out. |
|
CAPEC |
CAPEC-592 – Stored XSS CAPEC-588 – DOM-based XSS |
|
ASVS |
5.3.3 – Ensure there is sanitization of XSS not just for input but also for output |
|
CWE |
CWE-80 – Improper neutralization... |
