The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
N/A
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2019-12799
chain: bypass of untrusted deserialization issue (CWE-502) by using an assumed-trusted class (CWE-183)
CVE: CVE-2019-10458
sandbox bypass using a method that is on an allowlist
CVE: CVE-2017-1000095
sandbox bypass using unsafe methods that are on an allowlist
CVE: CVE-2019-10458
CI/CD pipeline feature has unsafe elements in allowlist, allowing bypass of script restrictions
CVE: CVE-2017-1000095
Default allowlist includes unsafe methods, allowing bypass of sandbox
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
N/A