目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-74 输出中的特殊元素转义处理不恰当(注入) 类漏洞列表 397

CWE-74 输出中的特殊元素转义处理不恰当(注入) 类弱点 397 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-74指下游组件注入漏洞，属输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，干扰下游组件对命令或数据的解析逻辑，从而执行非预期操作或篡改数据结构。开发者应避免直接拼接用户输入，需实施严格的输入过滤与输出编码，确保特殊元素被正确转义或隔离，防止其被下游组件误解释为可执行指令或结构标记。

MITRE CWE 官方描述
CWE：CWE-74 下游组件使用的输出中特殊元素的不当中和（'Injection'） 英文：产品使用来自上游组件的外部影响输入来构建命令、数据结构或记录的全部或部分内容，但在将其发送给下游组件时，未对可能修改其解析或解释方式的特殊元素进行中和，或中和不正确。
常见影响 (5)
ConfidentialityRead Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
OtherAlter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, OtherOther
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
缓解措施 (2)
RequirementsProgramming languages and supporting technologies might be chosen which are not subject to these issues.
ImplementationUtilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
代码示例 (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE ID标题CVSS风险等级Published
CVE-2019-11275 Pivotal Software Application Manager 安全漏洞 — Apps Manager 3.5 -2019-10-01
CVE-2019-1939 Cisco Webex Teams 注入漏洞 — Cisco Webex Teams 8.8 -2019-09-05
CVE-2019-3562 Oculus Browser 跨站脚本漏洞 — Oculus Browser 6.1 -2019-04-29
CVE-2019-1680 Cisco Webex Business Suite 输入验证错误漏洞 — Cisco Webex Business Suite 4.3 -2019-02-07
CVE-2018-18992 LCDS LAquis SCADA 注入漏洞 — LCDS Laquis SCADA 9.8 -2019-02-05
CVE-2018-18996 LCDS LAquis SCADA 安全漏洞 — LCDS Laquis SCADA 9.8 -2019-02-05
CVE-2017-16719 Moxa NPort 5110、5130和5150 安全漏洞 — Moxa NPort 5110, 5130, and 5150 7.5 -2017-11-16

CWE-74（输出中的特殊元素转义处理不恰当(注入)） 是常见的弱点类别，本平台收录该类弱点关联的 397 条 CVE 漏洞。