CVE-2001-1157
published 2001-08-12CVE-2001-1157: Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering…
PriorityP423high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.44%
82.3th percentile
Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| baltimore_technologies | websweeper | — | — |
| baltimore_technologies | websweeper | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Improper Handling of Additional Special Element
mitre_cwe
CWE-167 Improper Handling of Additional Special Element
CWE-167: Improper Handling of Additional Special Element
The product receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Unexpected State.
Potential Mitigations:
Developers should anticipate that extra special elements will be injected in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any i
CWE
Doubled Character XSS Manipulations
mitre_cwe
CWE-85 Doubled Character XSS Manipulations
CWE-85: Doubled Character XSS Manipulations
The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality, Integrity, Availability. Impact: Read Application Data, Execute Unauthorized Code or Commands.
Potential Mitigations:
[Implementation] Resolve all filtered input to absolute or canonical representations before processing.
[Implementation] Carefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including tag attributes,
CWE
Collapse of Data into Unsafe Value
mitre_cwe
CWE-182 Collapse of Data into Unsafe Value
CWE-182: Collapse of Data into Unsafe Value
The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Access Control. Impact: Bypass Protection Mechanism.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts
2001-08-12
Published