An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).
View on MITREActiveX controls can exercise far greater control over the operating system than typical Java or javascript. Exposed methods can be subject to various vulnerabilities, depending on the implemented behaviors of those methods, and whether input validation is performed on the provided arguments. If there is no integrity checking or origin validation, this method could be invoked by attackers.
If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.
Use code signing, although this does not protect against any weaknesses that are already in the control.
Where possible, avoid marking the control as safe for scripting.
No detection method information available for this CWE.
No relationship information available for this CWE.
CWE-618: Exposed Unsafe ActiveX Method is a Common Weakness Enumeration (CWE) entry maintained by MITRE. An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain). ActiveX controls can exercise far greater control over the operating system than typical Java or javascript. Exposed methods can be subject to various vulnerabilities, depending on the implemented behaviors of those methods, and whether input validation is performed on the provided arguments. If there is no integrity checking or origin validation, this method could be invoked by attackers.
If exploited, CWE-618 (Exposed Unsafe ActiveX Method) it can compromise Other, leading to outcomes such as Other.
Recommended mitigations for CWE-618 include: If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities. Use code signing, although this does not protect against any weaknesses that are already in the control. Where possible, avoid marking the control as safe for scripting.
MITRE documents real CVEs mapped to CWE-618, including CVE-2007-1120, CVE-2006-6838 and CVE-2007-0321. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-618 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.