Lack of data validation - Web Service
Description
The application does not control on the server side the data being sent in certain fields and allows the use of special characters, which leads to new attack vectors. In addition, there is no adequate control over the size of the fields that can be sent to the server.
Impact
- Exhaust server resources in the file storage space.
- Achieve XSS, SQLi or HTML injection to have a wider attack vector.
Recommendation
- Validate on the server side, the types of data that are entered by using white lists, where a set of accepted characters is defined.
- Validate the minimum and maximum length for the data entered by the user.
Threat
Anonymous attacker from intranet.
Expected Remediation Time
⌚ 30 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: A
- Attack complexity: L
- Privileges required: N
- User interaction: N
- Scope: U
- Confidentiality: N
- Integrity: L
- Availability: L
Temporal
- Exploit code maturity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:X
- Score:
- Base: 5.4
- Temporal: 5.4
- Severity:
- Base: Medium
- Temporal: Medium
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: A
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): L
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X
Result 4.0
- Vector string: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
- Score:
- CVSS-BT: 5.3
- Severity:
- CVSS-BT: Medium
Requirements
Fixes
