CWE - CWE-92: DEPRECATED: Improper Sanitization of Custom Special Characters (1.6)

Home > CWE List > CWE- Individual Dictionary Definition (1.6)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents

Community
Related Activities
Discussion List
Research
CWE/SANS Top 25
CWSS

News
Calendar
Free Newsletter

Compatibility
Program
Requirements
Declarations
Make a Declaration

Contact Us
Search the Site

CWE-92: DEPRECATED: Improper Sanitization of Custom Special Characters

DEPRECATED: Improper Sanitization of Custom Special Characters

Weakness ID: 92 (Deprecated Weakness Base)

Status: Deprecated

Description

Description Summary

The software uses a custom or proprietary language or representation, but when it receives input from an upstream component, it does not sanitize or incorrectly sanitizes special elements when they are sent to a downstream component.

Extended Description

This allows attackers to modify the syntax, content, or commands before they are processed by a downstream component.

Maintenance Notes

This and some other CWE entries were distinct in PLOVER but effectively have overlap in CWE. PLOVER sometimes defined "other" and "miscellaneous" categories in order to satisfy exhaustiveness requirements for taxonomies. Within the context of CWE, the use of a more abstract entry is preferred in mapping situations.

Content History

Submissions
Submission Date	Submitter	Organization	Source
	PLOVER		Externally Mined

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Time of Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Maintenance Notes, Relationships, Relationship Notes, Taxonomy Mappings, Weakness Ordinalities
2008-10-14	CWE Content Team	MITRE	Internal
2008-10-14	updated Description, Name
2009-05-27	CWE Content Team	MITRE	Internal
2009-05-27	updated Description, Name
2009-07-27	CWE Content Team	MITRE	Internal
2009-07-27	updated Applicable Platforms, Causal Nature, Maintenance Notes, Name, Observed Examples, Potential Mitigations, Related Attack Patterns, Relationship Notes, Relationships, Research Gaps, Taxonomy Mappings, Time of Introduction, Type, Weakness Ordinalities
2009-10-29	CWE Content Team	MITRE	Internal
2009-10-29	updated Relationships

Page Last Updated: October 29, 2009


	CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us