Control Strategy PatchingAtService

(empty)

CC.AuC.DFrXSS.3

Reflected XSS exploit on Client via Service injected via client input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Client from FlowsFrom can exploit a bug in Service to send a harmful script to the client browser. We assume this will make the browser leak authentication credentials, such as a password or session key.

CC.AuC.DFsXSS.3

Stored XSS exploit against Client by Service injected via input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Service from FlowsFrom can exploit a bug in Service, and send a harmful script to a trusting client browser Client. We assume this will make the browser leak authentication credentials, such as a password or session key.

CC.AuC.DSrXSS.3

Reflected XSS exploit on Client from Service injected via locally stored client input Data: an attacker who can inject malicious content into locally stored input Data used by Client can exploit a bug in Service and send a harmful script to the client browser. We assume this will make the browser leak authentication credentials, such as a password or session key.

CC.AuC.DSsXSS.3

Stored XSS exploit from Service against Client: an attacker who can inject malicious content into service input Data stored on SHost can exploit a bug in Service, and send a harmful script to a trusting client browser Client. We assume this will make the browser leak authentication credentials, such as a password or session key.

P.V.CCCSACvLS.2

Adjacent authenticated exploit as Client on service Service from LogicalSubnet: an attacker able to authenticate as client Client and access Service via an adjacent subnet LogicalSubnet used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.

P.V.CCCS-iAC.2

Remote authenticated exploit as Client on service Service: an attacker able to authenticate as client Client and access Service from a direction used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.

P.V.CCCvsCCSAC.2

Remote authenticated exploit as Client on service Service: an attacker able to authenticate as client Client and access Service from a direction used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.

P.V.CSAPNaS.3

Remote anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can use a privileged network path to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.

P.V.OSAPLaS.3

Adjacent anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can exploit firewall policy exceptions enabling access to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.

P.V.OSAPNaS.3

Remote anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can use a privileged network path to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.

P.V.SPNaS.2

Remote authenticated exploit on service Service via reverse proxy Client: a malicious user or attacker able send messages to Service via reverse proxy Client can send a malicious request that can exploit a bug in Service after authentication.

P.W.CCCS.3

Worm propagation exploit on service Service from Client: an infected client Client can send a message containing malware that without authentication, can exploit a bug in Service and infect the process.