Weakness · High
CWE-105: Struts: Form Field Without Validator
What it is
The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Omitting validation for even a single input field may give attackers the leeway they need to compromise the product. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
What an attacker can do
- Unexpected State (Integrity)
- Bypass Protection Mechanism (Integrity)
How to prevent it
Implementation
- Validate all form fields. If a field is unused, it is still important to constrain it so that it is empty or undefined.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.