Jack of Elevation of Privilege
An attacker can reflect input back to a user, such as in cross-site scripting (XSS).
|
Threat |
|
|
|
You’re not checking data entered in web forms, so when an attacker puts script or HTML into a form field, that data is sent to the server, and you then include this data in the response, which, when returned to the browser, is executed or rendered. |
|
CAPEC |
CAPEC-63 – XSS CAPEC-591 – Reflected XSS CAPEC-588 – DOM-based XSS |
|
ASVS |
5.1.3 – Validate all untrusted data and use allow lists where possible 5.3.3. – Make sure you’re sanitizing or encoding your output as well as your input |
|
CWE |
CWE-79 – Improper neutralization of input during... |
