CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
About
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common consequences
- Confidentiality → Read Application Data
- Access Control → Bypass Protection Mechanism
- Other → Alter Execution Logic
- Integrity, Other → Other
- Non-Repudiation → Hide Activities
Mitigations
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
CVEs with this weakness
Frequently asked questions
What is CWE-74?
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How likely is CWE-74 to be exploited?
MITRE rates the likelihood of exploit for CWE-74 as high.
How many CVEs does Rainforest track for CWE-74?
Rainforest Labs currently tracks 2 published CVEs mapped to CWE-74. They are listed on this page.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.