CWE Database
/

CWE-623

Back to CWE list

CWE-623

Unsafe ActiveX Control Marked Safe For Scripting

Variant
Draft

Description

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Related Weaknesses

Common Consequences

Scope

Confidentiality
Integrity
Availability

Impact

Execute Unauthorized Code or Commands

Potential Mitigations

Architecture and Design

During development, do not mark it as safe for scripting.

System Configuration

After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.

CVE-2007-0617

control allows attackers to add malicious email addresses to bypass spam limits

CVE-2007-0219

web browser uses certain COM objects as ActiveX

CVE-2006-6510

kiosk allows bypass to read files

Applicable Platforms

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now