COMMON WEAKNESS ENUMERATIONDraft

CWE-623

Unsafe ActiveX Control Marked Safe For Scripting

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

Soyutlama

Variant

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

Genişletilmiş açıklama

This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Execute Unauthorized Code or Commands

Etkilenen güvenlik alanları: Confidentiality, Integrity, Availability

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
During development, do not mark it as safe for scripting.

System Configuration

Güvenli yapılandırma yaklaşımı

Detay
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.