目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-87 替代XSS语法转义处理不恰当 类漏洞列表 38

CWE-87 替代XSS语法转义处理不恰当 类弱点 38 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-87 属于跨站脚本攻击漏洞，指软件未能正确中和用户输入中的替代脚本语法。攻击者利用此缺陷，通过构造非标准或变形的脚本标签绕过输入过滤机制，从而在受害者浏览器中执行恶意代码，窃取数据或篡改页面。开发者应实施严格的白名单输入验证，对特殊字符进行统一编码，并采用上下文感知的输出编码策略，确保所有用户输入均被安全处理，防止替代语法被解析执行。

MITRE CWE 官方描述
CWE：CWE-87 替代 XSS 语法的处理不当 英文：产品未对用户可控的输入进行替代脚本语法的处理，或处理不当。
常见影响 (1)
Confidentiality, Integrity, AvailabilityRead Application Data, Execute Unauthorized Code or Commands
缓解措施 (5)
ImplementationResolve all input to absolute or canonical representations before processing.
ImplementationCarefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including tag attributes, hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS v…
ImplementationUse and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are i…
ImplementationWith Struts, write all data from form beans with the bean's filter attribute set to true.
ImplementationTo help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is n…
Effectiveness: Defense in Depth
代码示例 (1)
In the following example, an XSS neutralization method intends to replace script tags in user-supplied input with a safe equivalent:
public String preventXSS(String input, String mask) { return input.replaceAll("script", mask); }
Bad · Java
CVE ID标题CVSS风险等级Published
CVE-2023-35159 XWiki Platform 跨站脚本漏洞 — xwiki-platform 9.7 Critical2023-06-23
CVE-2023-35158 XWiki Platform 安全漏洞 — xwiki-platform 9.7 Critical2023-06-23
CVE-2023-35156 XWiki Platform 跨站脚本漏洞 — xwiki-platform 9.7 Critical2023-06-23
CVE-2022-20963 Cisco Identity Services Engine 跨站脚本漏洞 — Cisco Identity Services Engine Software 5.4 Medium2022-11-03
CVE-2022-39295 Knowage 跨站脚本漏洞 — Knowage-Server 6.1 Medium2022-10-13
CVE-2022-36033 jsoup 跨站脚本漏洞 — jsoup 6.1 Medium2022-08-29
CVE-2021-40131 Cisco Common Services Platform Collector 跨站脚本漏洞 — Cisco Common Services Platform Collector Software 5.5 Medium2021-11-18
CVE-2020-5298 October CMS 跨站脚本漏洞 — october 4.0 Medium2020-06-03

CWE-87（替代XSS语法转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 38 条 CVE 漏洞。