CWE - CWE-713: OWASP Top Ten 2007 Category A2

Home > CWE List > CWE- Individual Dictionary Definition (2.4)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents
FAQs

Community
SwA On-Ramp
T-Shirt
Discussion List
Discussion Archives
Contact Us

Scoring
CWSS
CWRAF
CWE/SANS Top 25

Compatibility
Requirements
Coverage Claims Representation
Compatible Products
Make a Declaration

News
Calendar
Free Newsletter

Search the Site

CWE-713: OWASP Top Ten 2007 Category A2 - Injection Flaws

OWASP Top Ten 2007 Category A2 - Injection Flaws

Category ID: 713 (Category)

Status: Incomplete

Description

Description Summary

Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2007.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ParentOf	Weakness Class	77	Improper Neutralization of Special Elements used in a Command ('Command Injection')	Weaknesses in OWASP Top Ten (2007) (primary)629
ParentOf	Weakness Base	89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Weaknesses in OWASP Top Ten (2007) (primary)629
ParentOf	Weakness Base	90	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')	Weaknesses in OWASP Top Ten (2007) (primary)629
ParentOf	Weakness Base	91	XML Injection (aka Blind XPath Injection)	Weaknesses in OWASP Top Ten (2007) (primary)629
ParentOf	Weakness Base	93	Improper Neutralization of CRLF Sequences ('CRLF Injection')	Weaknesses in OWASP Top Ten (2007) (primary)629
MemberOf	View	629	Weaknesses in OWASP Top Ten (2007)	Weaknesses in OWASP Top Ten (2007) (primary)629

Related Attack Patterns

CAPEC-ID	Attack Pattern Name	(CAPEC Version: 1.7.1)
101	Server Side Include (SSI) Injection
14	Client-side Injection-induced Buffer Overflow
15	Command Delimiters
18	Embedding Scripts in Nonscript Elements
19	Embedding Scripts within Scripts
199	Cross-Site Scripting Using Alternate Syntax
23	File System Function Injection, Content Based
244	Cross-Site Scripting via Encoded URI Schemes
32	Embedding Scripts in HTTP Query Strings
34	HTTP Response Splitting
41	Using Meta-characters in E-mail Headers to Inject Malicious Payloads
44	Overflow Binary Resource File
6	Argument Injection
63	Simple Script Injection
66	SQL Injection
7	Blind SQL Injection
75	Manipulating Writeable Configuration Files
81	Web Logs Tampering
83	XPath Injection
84	XQuery Injection
86	Embedding Script (XSS ) in HTTP Headers
88	OS Command Injection
91	XSS in IMG Tags
93	Log Injection-Tampering-Forging

Content History

Submissions
Submission Date	Submitter	Organization	Source
2008-09-09		MITRE	Internal CWE Team
2008-09-09
Modifications
Modification Date	Modifier	Organization	Source
2009-12-28	CWE Content Team	MITRE	Internal
2009-12-28	updated Related_Attack_Patterns
2012-05-11	CWE Content Team	MITRE	Internal
2012-05-11	updated Related_Attack_Patterns

Page Last Updated: February 20, 2013


	CWE is co-sponsored by the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2013, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us