COMMON WEAKNESS ENUMERATIONDraft

CWE-623

Unsafe ActiveX Control Marked Safe For Scripting

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

Extended description

This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Execute Unauthorized Code or Commands

Affected security scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and fixed?

Architecture and Design

Architecture and design approach

Detail
During development, do not mark it as safe for scripting.

System Configuration

Secure configuration approach

Detail
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.