CWE-838
Inappropriate Encoding for Output Context
The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
CVE-2020-7292 (GCVE-0-2020-7292)
Vulnerability from cvelistv5
Published
2020-07-15 14:50
Modified
2024-08-04 09:25
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-838 - Inappropriate Encoding for output context
Summary
Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| McAfee | McAfee Web Gateway (MWG) |
Version: unspecified < 9.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:25:48.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10323"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "McAfee Web Gateway (MWG)",
"vendor": "McAfee",
"versions": [
{
"lessThan": "9.2.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838 Inappropriate Encoding for output context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-14T15:35:31.000Z",
"orgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
"shortName": "trellix"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10323"
}
],
"source": {
"advisory": "SB10323",
"discovery": "EXTERNAL"
},
"title": "Web Gateway (MWG) - Inappropriate Encoding for output context",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@mcafee.com",
"ID": "CVE-2020-7292",
"STATE": "PUBLIC",
"TITLE": "Web Gateway (MWG) - Inappropriate Encoding for output context"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "McAfee Web Gateway (MWG)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "9.2.1"
}
]
}
}
]
},
"vendor_name": "McAfee"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-838 Inappropriate Encoding for output context"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10323",
"refsource": "MISC",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10323"
}
]
},
"source": {
"advisory": "SB10323",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
"assignerShortName": "trellix",
"cveId": "CVE-2020-7292",
"datePublished": "2020-07-15T14:50:14.000Z",
"dateReserved": "2020-01-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T09:25:48.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5770 (GCVE-0-2023-5770)
Vulnerability from cvelistv5
Published
2024-01-09 22:02
Modified
2025-06-03 14:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-838 - Inappropriate Encoding for Output Context
Summary
Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Proofpoint | Proofpoint Enterprise Protection |
Version: 8.20.2 ≤ Version: 8.20.0 ≤ Version: 8.18.6 ≤ Version: 8.0 ≤ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:32.637Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T18:43:41.522534Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T14:29:46.790Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Email Delivery Agent"
],
"product": "Proofpoint Enterprise Protection",
"vendor": "Proofpoint",
"versions": [
{
"changes": [
{
"at": "patch 4809",
"status": "unaffected"
}
],
"lessThan": "patch 4809",
"status": "affected",
"version": "8.20.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "patch 4805",
"status": "unaffected"
}
],
"lessThan": "patch 4805",
"status": "affected",
"version": "8.20.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "patch 4804",
"status": "unaffected"
}
],
"lessThan": "patch 4804",
"status": "affected",
"version": "8.18.6",
"versionType": "semver"
},
{
"lessThan": "8.18.6",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eProofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.\u003c/span\u003e\u003cp\u003eThis issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.\u003c/p\u003e"
}
],
"value": "Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838 Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-09T22:02:03.839Z",
"orgId": "d83a79dd-e128-4b83-8b64-84faf54eed46",
"shortName": "Proofpoint"
},
"references": [
{
"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTML injection in email body through email subject",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d83a79dd-e128-4b83-8b64-84faf54eed46",
"assignerShortName": "Proofpoint",
"cveId": "CVE-2023-5770",
"datePublished": "2024-01-09T22:02:03.839Z",
"dateReserved": "2023-10-25T17:57:53.751Z",
"dateUpdated": "2025-06-03T14:29:46.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-34006 (GCVE-0-2024-34006)
Vulnerability from cvelistv5
Published
2024-05-31 20:36
Modified
2024-08-02 02:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-838 - Inappropriate Encoding for Output Context
Summary
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fedora",
"vendor": "fedoraproject",
"versions": [
{
"lessThanOrEqual": "4.3.3",
"status": "affected",
"version": "4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fedora",
"vendor": "fedoraproject",
"versions": [
{
"lessThanOrEqual": "4.1.9",
"status": "affected",
"version": "4.1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fedora",
"vendor": "fedoraproject",
"versions": [
{
"lessThanOrEqual": "4.2.6",
"status": "affected",
"version": "4.2",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-34006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T15:10:13.250364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:42:30.475Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://moodle.org/mod/forum/discuss.php?d=458395"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://git.moodle.org",
"defaultStatus": "unknown",
"packageName": "Moodle",
"versions": [
{
"lessThanOrEqual": "4.3.3",
"status": "affected",
"version": "4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.6",
"status": "affected",
"version": "4.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.1.9",
"status": "affected",
"version": "4.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Leon Stringer"
}
],
"datePublic": "2024-05-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eThe site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.\u003c/pre\u003e\u003cbr\u003e"
}
],
"value": "The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838 Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-31T20:36:08.390Z",
"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
"shortName": "fedora"
},
"references": [
{
"url": "https://moodle.org/mod/forum/discuss.php?d=458395"
}
],
"title": "moodle: unsanitized HTML in site log for config_log_created"
}
},
"cveMetadata": {
"assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
"assignerShortName": "fedora",
"cveId": "CVE-2024-34006",
"datePublished": "2024-05-31T20:36:08.390Z",
"dateReserved": "2024-04-29T13:02:30.267Z",
"dateUpdated": "2024-08-02T02:42:59.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-47079 (GCVE-0-2026-47079)
Vulnerability from cvelistv5
Published
2026-08-21 09:52
Modified
2026-08-21 12:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-838 - Inappropriate Encoding for Output Context
Summary
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.
XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as <script> is emitted verbatim into the serialized XML rather than being escaped to &lt;script&gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.
This issue affects xml_builder: from 0.0.6 before 2.4.1.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| joshnuss | xml_builder |
Version: 0.0.6 ≤ cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47079",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:17:52.012230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:19:47.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_string/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_entity/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.6",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_string/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_entity/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "c3390e2046ec297b3bb8c30d5779cdfd6508c275",
"status": "affected",
"version": "aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, Cross-site Scripting.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape_string/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape_entity/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e does not escape literal \u003ccode\u003e\u0026amp;\u003c/code\u003e characters in text or attribute values when they are followed by an entity-like token (\u003ccode\u003elt;\u003c/code\u003e, \u003ccode\u003egt;\u003c/code\u003e, \u003ccode\u003eamp;\u003c/code\u003e, \u003ccode\u003equot;\u003c/code\u003e, \u003ccode\u003eapos;\u003c/code\u003e). As a result, attacker-supplied input such as \u003ccode\u003e\u0026amp;lt;script\u0026amp;gt;\u003c/code\u003e is emitted verbatim into the serialized XML rather than being escaped to \u003ccode\u003e\u0026amp;amp;lt;script\u0026amp;amp;gt;\u003c/code\u003e. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw \u003ccode\u003e\u0026lt;\u003c/code\u003e and \u003ccode\u003e\u0026gt;\u003c/code\u003e characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.6 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, Cross-site Scripting.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape_string/1`, `XmlBuilder.escape_entity/1`.\n\n`XmlBuilder.generate/1` does not escape literal `\u0026` characters in text or attribute values when they are followed by an entity-like token (`lt;`, `gt;`, `amp;`, `quot;`, `apos;`). As a result, attacker-supplied input such as `\u0026lt;script\u0026gt;` is emitted verbatim into the serialized XML rather than being escaped to `\u0026amp;lt;script\u0026amp;gt;`. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters `\u003cscript\u003e`, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw `\u003c` and `\u003e` characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\n\nThis issue affects xml_builder: from 0.0.6 before 2.4.1."
}
],
"value": "Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.\n\nXmlBuilder.generate/1 does not escape literal \u0026 characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as \u0026lt;script\u0026gt; is emitted verbatim into the serialized XML rather than being escaped to \u0026amp;lt;script\u0026amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters \u003cscript\u003e, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw \u003c and \u003e characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\n\nThis issue affects xml_builder: from 0.0.6 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-120",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-120 Double Encoding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838 Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:52:44.178Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47079.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47079"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/c3390e2046ec297b3bb8c30d5779cdfd6508c275"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Round-trip Corruption via Improper Entity Escaping in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47079",
"datePublished": "2026-08-21T09:52:44.178Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-08-21T12:19:47.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53641 (GCVE-0-2026-53641)
Vulnerability from cvelistv5
Published
2026-07-06 22:36
Modified
2026-07-08 19:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| FOSSBilling | FOSSBilling |
Version: >= 0.6.0, < 0.8.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-08T17:48:10.248215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T19:41:51.333Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FOSSBilling",
"vendor": "FOSSBilling",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.6.0, \u003c 0.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838: Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T22:41:27.429Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-q6c8-6r72-35f7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-q6c8-6r72-35f7"
}
],
"source": {
"advisory": "GHSA-q6c8-6r72-35f7",
"discovery": "UNKNOWN"
},
"title": "FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53641",
"datePublished": "2026-07-06T22:36:38.105Z",
"dateReserved": "2026-06-09T20:16:59.648Z",
"dateUpdated": "2026-07-08T19:41:51.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55858 (GCVE-0-2026-55858)
Vulnerability from cvelistv5
Published
2026-08-28 22:46
Modified
2026-08-28 22:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-838 - Inappropriate Encoding for Output Context
Summary
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-j |
Version: < 2.7.14 Version: >= 3.0.0-alpha, < 3.3.5 Version: >= 3.4.0, < 3.4.3 Version: >= 3.5.0, < 3.5.9 |
{
"containers": {
"cna": {
"affected": [
{
"product": "mariadb-connector-j",
"vendor": "mariadb-corporation",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.14"
},
{
"status": "affected",
"version": "\u003e= 3.0.0-alpha, \u003c 3.3.5"
},
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.4.3"
},
{
"status": "affected",
"version": "\u003e= 3.5.0, \u003c 3.5.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-session change to character_set_client through OK-packet session-state tracking, including a change caused by SET NAMES, a stored routine or trigger, server configuration, or a hostile server. If character_set_client changes to a non-UTF-8 value, the driver continues to read and write UTF-8 while the server interprets the same bytes under another encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value causes SQLException with SQLState 08000 and closes the connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838: Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T22:46:40.114Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-xvr9-35cr-46v9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-xvr9-35cr-46v9"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/300716bef1e1d0370a41be7863b88aa2d55fbb69"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/7b3c69221b5463ee03472654040b3f6b9e5329c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/7b3c69221b5463ee03472654040b3f6b9e5329c7"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/8cfd9df697372ad4ed09fe87a34b34babb6d43d6"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/c555c9b477521be0c35c3a5461f9f46681553607",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/c555c9b477521be0c35c3a5461f9f46681553607"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/2.7.14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/2.7.14"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.5"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9"
},
{
"name": "https://jira.mariadb.org/browse/CONJ-1317",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/CONJ-1317"
}
],
"source": {
"advisory": "GHSA-xvr9-35cr-46v9",
"discovery": "UNKNOWN"
},
"title": "MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55858",
"datePublished": "2026-08-28T22:46:40.114Z",
"dateReserved": "2026-06-17T16:44:40.995Z",
"dateUpdated": "2026-08-28T22:46:40.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55859 (GCVE-0-2026-55859)
Vulnerability from cvelistv5
Published
2026-08-28 22:48
Modified
2026-08-28 22:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-r2dbc |
Version: < 1.4.1 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "mariadb-connector-r2dbc",
"vendor": "mariadb-corporation",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.1"
}
]
},
{
"product": "r2dbc-mariadb",
"vendor": "org.mariadb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-packet session-state-tracking mechanism, including through SET NAMES executed by a stored routine or trigger, server configuration, or a hostile or man-in-the-middle server. If the new character set is not UTF-8, the driver continues to exchange UTF-8 while the server interprets the same bytes under a different encoding, causing silent data corruption and a client/server charset-confusion mismatch that can defeat byte-wise quoting or escaping. The fix accepts only utf8, utf8mb3, or utf8mb4 after initialization; any other value raises R2dbcNonTransientResourceException with SQLState 08000 and closes the connection. This issue is fixed in version 1.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838: Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T22:48:41.592Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-5rqc-86vf-g8r2"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/38bad9afebc6c581a853656a42f9ebf403b1b1b7"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1"
},
{
"name": "https://jira.mariadb.org/browse/R2DBC-124",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/R2DBC-124"
}
],
"source": {
"advisory": "GHSA-5rqc-86vf-g8r2",
"discovery": "UNKNOWN"
},
"title": "MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55859",
"datePublished": "2026-08-28T22:48:41.592Z",
"dateReserved": "2026-06-17T16:44:40.995Z",
"dateUpdated": "2026-08-28T22:48:41.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Phase: Implementation
Strategy: Output Encoding
Description:
- Use context-aware encoding. That is, understand which encoding is being used by the downstream component, and ensure that this encoding is used. If an encoding can be specified, do so, instead of assuming that the default encoding is the same as the default being assumed by the downstream component.
Mitigation
Phase: Architecture and Design
Strategy: Output Encoding
Description:
- Where possible, use communications protocols or data formats that provide strict boundaries between control and data. If this is not feasible, ensure that the protocols or formats allow the communicating components to explicitly state which encoding/decoding method is being used. Some template frameworks provide built-in support.
Mitigation ID: MIT-4.3
Phase: Architecture and Design
Strategy: Libraries or Frameworks
Description:
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
- Note that some template mechanisms provide built-in support for the appropriate encoding.
CAPEC-468: Generic Cross-Browser Cross-Domain Theft
An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser.