DerScanner
Home / Vulnerability Database / Java : Unsafe encoding
Java

Java : Unsafe encoding

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A6-Security Misconfiguration
OWASP Top 10 2021
A5-Security Misconfiguration
OWASP MASVS
V6: 6.2.(L1/L2/L1+R/L2+R)
OWASP ASVS
Validation, Sanitization and EncodingValidation, Sanitization and Encoding
PCI DSS 4.0
6.2.4
CWE
CWE-176CWE-1032

Overview

The used encoding algorithm does not provide complete protection against code injection. The encoding algorithms such as HTML-encode, JS-encode, URL-encode are not a sufficient protection.

References

  1. CWE-176: Improper Handling of Unicode Encoding
  2. OWASP: ESAPI Secure Coding Guideline
  3. OWASP Top 10 2017-A6-Security Misconfiguration
  4. CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
  5. CWE-174: Double Decoding of the Same Data
  6. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MEDIUM

DerScanner Severity Score

Do you want to fix Java : Unsafe encoding in your application?

See also

Java

Java : Race condition

Java

Java : Text4Shell Vulnerability

Java

Java : JNI usage