cve.bz

CWE-183: Permissive List of Allowed Inputs, page 2

Filter

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

What the weakness is: CWE-183 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 4
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-183, as MITRE names them. Credits.

Ask an AI about CWE-183

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-183: Permissive List of Allowed Inputs and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/183.html and https://cve.bz/cve/cwe/183?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2022-42469EPSS 0.4%

    A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal.

  2. 6.7CVE-2022-34450EPSS 0.4%

    PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially exploit this issue and gain unrestricted control/code execution on the system as root.

  3. 4.4CVE-2022-23158EPSS 0.7%

    Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get co…

  4. 5.3CVE-2021-40128EPSS 1.0%

    A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is…

  5. 5.3CVE-2021-34787EPSS 1.0%

    A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass s…

  6. 7.5CVE-2020-25696EPSS 2.7%

    A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server…

  7. 4.9CVE-2020-1694EPSS 1.6%

    A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.