CWE-623: Unsafe ActiveX Control Marked Safe For Scripting
Description
An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.
This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- ConfidentialityIntegrityAvailability
Execute Unauthorized Code or Commands
Potential mitigations
- Architecture and Design
During development, do not mark it as safe for scripting.
- System Configuration
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.