CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework
ASP.NET Misconfiguration: Not Using Input Validation Framework
Weakness ID: 554 (Weakness Variant)
Status: Draft
Description
Description Summary
The ASP.NET application does not use an input validation framework.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
.NET
Common Consequences
Scope
Effect
Integrity
Technical Impact: Unexpected state
Unchecked input leads to cross-site scripting, process control, and
SQL injection vulnerabilities, among others.
Potential Mitigations
Phase: Architecture and Design
Use the ASP.NET validation framework to check all program input before
it is processed by the application. Example uses of the validation
framework include checking to ensure that:
Phone number fields contain only valid characters in phone
numbers
Boolean values are only "T" or "F"
Free-form strings are of a reasonable length and
composition
Description
