CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

VariantDraft

The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple

Applicable To

Languages
Not Language-Specific
Platforms

Frequently Asked Questions

What is CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page?+

CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

What are the security consequences of Improper Neutralization of Server-Side Includes (SSI) Within a Web Page?+

If exploited, CWE-97 (Improper Neutralization of Server-Side Includes (SSI) Within a Web Page) it can compromise Confidentiality, Integrity and Availability, leading to outcomes such as Execute Unauthorized Code or Commands.

Which programming languages are affected by Improper Neutralization of Server-Side Includes (SSI) Within a Web Page?+

CWE-97 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-97 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More