目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-81 错误消息Web页面中脚本转义处理不恰当 类漏洞列表 6

CWE-81 错误消息Web页面中脚本转义处理不恰当 类弱点 6 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-81 属于脚本注入漏洞，指程序在生成错误页面时未正确过滤用户输入中的特殊字符。攻击者通过触发包含恶意脚本语法（如 XSS）的错误响应，将脚本注入到网页中，从而在受害者浏览器中执行任意代码。开发者应避免直接展示原始输入，需对错误信息中的用户数据进行严格的 HTML 实体编码或输出编码，确保脚本标签被当作纯文本处理，从而阻断攻击链。

MITRE CWE 官方描述
CWE：CWE-81 错误消息网页中脚本的不当中和 英文：产品从上游组件接收输入，但未对特殊字符进行中和或中和不当，当这些字符被发送到错误页面时，可能被解释为 Web 脚本元素。 错误页面可能包括自定义的 403 Forbidden（禁止访问）或 404 Not Found（未找到）页面。当攻击者能够触发一个在其输入中包含脚本语法的错误时，则可能发生跨站脚本（Cross-Site Scripting, XSS）攻击。
常见影响 (1)
Confidentiality, Integrity, AvailabilityRead Application Data, Execute Unauthorized Code or Commands
缓解措施 (5)
ImplementationDo not write user-controlled input to error pages.
ImplementationCarefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities i…
ImplementationUse and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are i…
ImplementationWith Struts, write all data from form beans with the bean's filter attribute set to true.
ImplementationTo help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is n…
Effectiveness: Defense in Depth
CVE ID标题CVSS风险等级Published
CVE-2025-24344 Bosch Rexroth ctrlX OS 安全漏洞 — ctrlX OS - Solutions 6.3 Medium2025-04-30
CVE-2025-0883 OpenText Service Management Automation X 安全漏洞 — Service Manager 4.3 -2025-03-12
CVE-2024-6892 Journyx 安全漏洞 — Journyx (jtime) 6.1AIMediumAI2024-08-07
CVE-2022-4137 Red Hat Keycloak 跨站脚本漏洞 — Red Hat Single Sign-On 7 8.1 High2023-09-25
CVE-2022-4361 Red Hat Keycloak 跨站脚本漏洞 — keycloak 10.0 Critical2023-07-07
CVE-2019-25027 Vaadin flow 跨站脚本漏洞 — Vaadin 6.1 Medium2021-04-23

CWE-81（错误消息Web页面中脚本转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 6 条 CVE 漏洞。