vrt 0.12.5 → 0.12.6

Sign up to get free protection for your applications and to get access to all the features.
Files changed (13) hide show
  1. checksums.yaml +4 -4
  2. data/lib/data/1.13/deprecated-node-mapping.json +236 -0
  3. data/lib/data/1.13/mappings/cvss_v3/cvss_v3.json +1368 -0
  4. data/lib/data/1.13/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  5. data/lib/data/1.13/mappings/cwe/cwe.json +756 -0
  6. data/lib/data/1.13/mappings/cwe/cwe.schema.json +63 -0
  7. data/lib/data/1.13/mappings/remediation_advice/remediation_advice.json +1938 -0
  8. data/lib/data/1.13/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  9. data/lib/data/1.13/third-party-mappings/remediation_training/secure-code-warrior-links.json +421 -0
  10. data/lib/data/1.13/vrt.schema.json +63 -0
  11. data/lib/data/1.13/vulnerability-rating-taxonomy.json +2623 -0
  12. data/lib/vrt/version.rb +1 -1
  13. metadata +17 -7
data/lib/data/1.13/mappings/cvss_v3/cvss_v3.json ADDED
@@ -0,0 +1,1368 @@
1
+ {
2
+ "metadata": {
3
+ "default": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
4
+ },
5
+ "content": [
6
+ {
7
+ "id": "server_security_misconfiguration",
8
+ "children": [
9
+ {
10
+ "id": "server_side_request_forgery_ssrf",
11
+ "children": [
12
+ {
13
+ "id": "internal_high_impact",
14
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
15
+ },
16
+ {
17
+ "id": "internal_scan_and_or_medium_impact",
18
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
19
+ },
20
+ {
21
+ "id": "external_low_impact",
22
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
23
+ },
24
+ {
25
+ "id": "external_dns_query_only",
26
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
27
+ }
28
+ ]
29
+ },
30
+ {
31
+ "id": "unsafe_cross_origin_resource_sharing",
32
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
33
+ },
34
+ {
35
+ "id": "request_smuggling",
36
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
37
+ },
38
+ {
39
+ "id": "path_traversal",
40
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
41
+ },
42
+ {
43
+ "id": "directory_listing_enabled",
44
+ "children": [
45
+ {
46
+ "id": "sensitive_data_exposure",
47
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
48
+ },
49
+ {
50
+ "id": "non_sensitive_data_exposure",
51
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
52
+ }
53
+ ]
54
+ },
55
+ {
56
+ "id": "same_site_scripting",
57
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
58
+ },
59
+ {
60
+ "id": "ssl_attack_breach_poodle_etc",
61
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
62
+ },
63
+ {
64
+ "id": "using_default_credentials",
65
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
66
+ },
67
+ {
68
+ "id": "misconfigured_dns",
69
+ "children": [
70
+ {
71
+ "id": "basic_subdomain_takeover",
72
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
73
+ },
74
+ {
75
+ "id": "high_impact_subdomain_takeover",
76
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
77
+ },
78
+ {
79
+ "id": "zone_transfer",
80
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
81
+ },
82
+ {
83
+ "id": "missing_caa_record",
84
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
85
+ }
86
+ ]
87
+ },
88
+ {
89
+ "id": "mail_server_misconfiguration",
90
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
91
+ "children": [
92
+ {
93
+ "id": "no_spoofing_protection_on_email_domain",
94
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
95
+ },
96
+ {
97
+ "id": "email_spoofing_to_inbox_due_to_missing_or_misconfigured_dmarc_on_email_domain",
98
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
99
+ }
100
+ ]
101
+ },
102
+ {
103
+ "id": "dbms_misconfiguration",
104
+ "children": [
105
+ {
106
+ "id": "excessively_privileged_user_dba",
107
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
108
+ }
109
+ ]
110
+ },
111
+ {
112
+ "id": "lack_of_password_confirmation",
113
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
114
+ "children": [
115
+ {
116
+ "id": "manage_two_fa",
117
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
118
+ }
119
+ ]
120
+ },
121
+ {
122
+ "id": "no_rate_limiting_on_form",
123
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
124
+ "children": [
125
+ {
126
+ "id": "login",
127
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
128
+ },
129
+ {
130
+ "id": "change_password",
131
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
132
+ }
133
+ ]
134
+ },
135
+ {
136
+ "id": "unsafe_file_upload",
137
+ "children": [
138
+ {
139
+ "id": "no_antivirus",
140
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
141
+ },
142
+ {
143
+ "id": "no_size_limit",
144
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
145
+ },
146
+ {
147
+ "id": "file_extension_filter_bypass",
148
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
149
+ }
150
+ ]
151
+ },
152
+ {
153
+ "id": "cookie_scoped_to_parent_domain",
154
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
155
+ },
156
+ {
157
+ "id": "missing_secure_or_httponly_cookie_flag",
158
+ "children": [
159
+ {
160
+ "id": "session_token",
161
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
162
+ },
163
+ {
164
+ "id": "non_session_cookie",
165
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
166
+ }
167
+ ]
168
+ },
169
+ {
170
+ "id": "clickjacking",
171
+ "children": [
172
+ {
173
+ "id": "sensitive_action",
174
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
175
+ },
176
+ {
177
+ "id": "form_input",
178
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
179
+ },
180
+ {
181
+ "id": "non_sensitive_action",
182
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
183
+ }
184
+ ]
185
+ },
186
+ {
187
+ "id": "oauth_misconfiguration",
188
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
189
+ "children": [
190
+ {
191
+ "id": "account_takeover",
192
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
193
+ },
194
+ {
195
+ "id": "account_squatting",
196
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
197
+ }
198
+ ]
199
+ },
200
+ {
201
+ "id": "captcha",
202
+ "children": [
203
+ {
204
+ "id": "implementation_vulnerability",
205
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
206
+ },
207
+ {
208
+ "id": "brute_force",
209
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
210
+ },
211
+ {
212
+ "id": "missing",
213
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
214
+ }
215
+ ]
216
+ },
217
+ {
218
+ "id": "exposed_admin_portal",
219
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
220
+ },
221
+ {
222
+ "id": "missing_dnssec",
223
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
224
+ },
225
+ {
226
+ "id": "fingerprinting_banner_disclosure",
227
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
228
+ },
229
+ {
230
+ "id": "username_enumeration",
231
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
232
+ },
233
+ {
234
+ "id": "potentially_unsafe_http_method_enabled",
235
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
236
+ },
237
+ {
238
+ "id": "insecure_ssl",
239
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
240
+ },
241
+ {
242
+ "id": "rfd",
243
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
244
+ },
245
+ {
246
+ "id": "lack_of_security_headers",
247
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
248
+ "children": [
249
+ {
250
+ "id": "cache_control_for_a_sensitive_page",
251
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
252
+ }
253
+ ]
254
+ },
255
+ {
256
+ "id": "waf_bypass",
257
+ "children": [
258
+ {
259
+ "id": "direct_server_access",
260
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
261
+ }
262
+ ]
263
+ },
264
+ {
265
+ "id": "race_condition",
266
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
267
+ },
268
+ {
269
+ "id": "cache_poisoning",
270
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
271
+ },
272
+ {
273
+ "id": "bitsquatting",
274
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
275
+ }
276
+ ]
277
+ },
278
+ {
279
+ "id": "server_side_injection",
280
+ "children": [
281
+ {
282
+ "id": "file_inclusion",
283
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
284
+ },
285
+ {
286
+ "id": "parameter_pollution",
287
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
288
+ },
289
+ {
290
+ "id": "remote_code_execution_rce",
291
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
292
+ },
293
+ {
294
+ "id": "ldap_injection",
295
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
296
+ },
297
+ {
298
+ "id": "sql_injection",
299
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
300
+ },
301
+ {
302
+ "id": "xml_external_entity_injection_xxe",
303
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
304
+ },
305
+ {
306
+ "id": "http_response_manipulation",
307
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
308
+ },
309
+ {
310
+ "id": "content_spoofing",
311
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
312
+ "children": [
313
+ {
314
+ "id": "iframe_injection",
315
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
316
+ },
317
+ {
318
+ "id": "impersonation_via_broken_link_hijacking",
319
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
320
+ },
321
+ {
322
+ "id": "external_authentication_injection",
323
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
324
+ },
325
+ {
326
+ "id": "flash_based_external_authentication_injection",
327
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
328
+ },
329
+ {
330
+ "id": "html_content_injection",
331
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
332
+ },
333
+ {
334
+ "id": "email_html_injection",
335
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
336
+ }
337
+ ]
338
+ },
339
+ {
340
+ "id": "ssti",
341
+ "children": [
342
+ {
343
+ "id": "basic",
344
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
345
+ },
346
+ {
347
+ "id": "custom",
348
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
349
+ }
350
+ ]
351
+ }
352
+ ]
353
+ },
354
+ {
355
+ "id": "broken_authentication_and_session_management",
356
+ "children": [
357
+ {
358
+ "id": "authentication_bypass",
359
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
360
+ },
361
+ {
362
+ "id": "two_fa_bypass",
363
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
364
+ },
365
+ {
366
+ "id": "privilege_escalation",
367
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
368
+ },
369
+ {
370
+ "id": "cleartext_transmission_of_session_token",
371
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
372
+ },
373
+ {
374
+ "id": "weak_login_function",
375
+ "children": [
376
+ {
377
+ "id": "not_operational",
378
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
379
+ },
380
+ {
381
+ "id": "other_plaintext_protocol_no_secure_alternative",
382
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
383
+ },
384
+ {
385
+ "id": "over_http",
386
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
387
+ }
388
+ ]
389
+ },
390
+ {
391
+ "id": "session_fixation",
392
+ "children": [
393
+ {
394
+ "id": "remote_attack_vector",
395
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
396
+ },
397
+ {
398
+ "id": "local_attack_vector",
399
+ "cvss_v3": "AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
400
+ }
401
+ ]
402
+ },
403
+ {
404
+ "id": "failure_to_invalidate_session",
405
+ "children": [
406
+ {
407
+ "id": "on_logout",
408
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
409
+ },
410
+ {
411
+ "id": "permission_change",
412
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
413
+ },
414
+ {
415
+ "id": "on_logout_server_side_only",
416
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
417
+ },
418
+ {
419
+ "id": "on_password_change",
420
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
421
+ },
422
+ {
423
+ "id": "all_sessions",
424
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
425
+ },
426
+ {
427
+ "id": "on_email_change",
428
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
429
+ },
430
+ {
431
+ "id": "on_two_fa_activation_change",
432
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
433
+ },
434
+ {
435
+ "id": "long_timeout",
436
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
437
+ }
438
+ ]
439
+ },
440
+ {
441
+ "id": "concurrent_logins",
442
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
443
+ },
444
+ {
445
+ "id": "weak_registration_implementation",
446
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
447
+ }
448
+ ]
449
+ },
450
+ {
451
+ "id": "sensitive_data_exposure",
452
+ "children": [
453
+ {
454
+ "id": "disclosure_of_secrets",
455
+ "children": [
456
+ {
457
+ "id": "for_publicly_accessible_asset",
458
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
459
+ },
460
+ {
461
+ "id": "pii_leakage_exposure",
462
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
463
+ },
464
+ {
465
+ "id": "for_internal_asset",
466
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
467
+ },
468
+ {
469
+ "id": "pay_per_use_abuse",
470
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
471
+ },
472
+ {
473
+ "id": "intentionally_public_sample_or_invalid",
474
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
475
+ },
476
+ {
477
+ "id": "data_traffic_spam",
478
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
479
+ },
480
+ {
481
+ "id": "non_corporate_user",
482
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
483
+ }
484
+ ]
485
+ },
486
+ {
487
+ "id": "exif_geolocation_data_not_stripped_from_uploaded_images",
488
+ "children": [
489
+ {
490
+ "id": "automatic_user_enumeration",
491
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
492
+ },
493
+ {
494
+ "id": "manual_user_enumeration",
495
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
496
+ }
497
+ ]
498
+ },
499
+ {
500
+ "id": "visible_detailed_error_page",
501
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
502
+ "children": [
503
+ {
504
+ "id": "detailed_server_configuration",
505
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
506
+ }
507
+ ]
508
+ },
509
+ {
510
+ "id": "disclosure_of_known_public_information",
511
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
512
+ },
513
+ {
514
+ "id": "token_leakage_via_referer",
515
+ "children": [
516
+ {
517
+ "id": "trusted_third_party",
518
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
519
+ },
520
+ {
521
+ "id": "untrusted_third_party",
522
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
523
+ },
524
+ {
525
+ "id": "over_http",
526
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
527
+ }
528
+ ]
529
+ },
530
+ {
531
+ "id": "sensitive_token_in_url",
532
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
533
+ },
534
+ {
535
+ "id": "non_sensitive_token_in_url",
536
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
537
+ },
538
+ {
539
+ "id": "weak_password_reset_implementation",
540
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
541
+ "children": [
542
+ {
543
+ "id": "token_leakage_via_host_header_poisoning",
544
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
545
+ }
546
+ ]
547
+ },
548
+ {
549
+ "id": "mixed_content",
550
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
551
+ },
552
+ {
553
+ "id": "sensitive_data_hardcoded",
554
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
555
+ },
556
+ {
557
+ "id": "internal_ip_disclosure",
558
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
559
+ },
560
+ {
561
+ "id": "xssi",
562
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
563
+ },
564
+ {
565
+ "id": "json_hijacking",
566
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
567
+ },
568
+ {
569
+ "id": "via_localstorage_sessionstorage",
570
+ "children": [
571
+ {
572
+ "id": "sensitive_token",
573
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
574
+ },
575
+ {
576
+ "id": "non_sensitive_token",
577
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
578
+ }
579
+ ]
580
+ }
581
+ ]
582
+ },
583
+ {
584
+ "id": "cross_site_scripting_xss",
585
+ "children": [
586
+ {
587
+ "id": "stored",
588
+ "children": [
589
+ {
590
+ "id": "non_admin_to_anyone",
591
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
592
+ },
593
+ {
594
+ "id": "privileged_user_to_privilege_elevation",
595
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
596
+ },
597
+ {
598
+ "id": "privileged_user_to_no_privilege_elevation",
599
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
600
+ },
601
+ {
602
+ "id": "url_based",
603
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
604
+ },
605
+ {
606
+ "id": "self",
607
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
608
+ }
609
+ ]
610
+ },
611
+ {
612
+ "id": "reflected",
613
+ "children": [
614
+ {
615
+ "id": "non_self",
616
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
617
+ },
618
+ {
619
+ "id": "self",
620
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
621
+ }
622
+ ]
623
+ },
624
+ {
625
+ "id": "flash_based",
626
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
627
+ },
628
+ {
629
+ "id": "cookie_based",
630
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
631
+ },
632
+ {
633
+ "id": "ie_only",
634
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
635
+ },
636
+ {
637
+ "id": "referer",
638
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
639
+ },
640
+ {
641
+ "id": "trace_method",
642
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
643
+ },
644
+ {
645
+ "id": "universal_uxss",
646
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
647
+ },
648
+ {
649
+ "id": "off_domain",
650
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
651
+ }
652
+ ]
653
+ },
654
+ {
655
+ "id": "broken_access_control",
656
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
657
+ "children": [
658
+ {
659
+ "id": "username_enumeration",
660
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
661
+ }
662
+ ]
663
+ },
664
+ {
665
+ "id": "cross_site_request_forgery_csrf",
666
+ "children": [
667
+ {
668
+ "id": "application_wide",
669
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
670
+ },
671
+ {
672
+ "id": "action_specific",
673
+ "children": [
674
+ {
675
+ "id": "authenticated_action",
676
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
677
+ },
678
+ {
679
+ "id": "unauthenticated_action",
680
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
681
+ },
682
+ {
683
+ "id": "logout",
684
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
685
+ }
686
+ ]
687
+ },
688
+ {
689
+ "id": "csrf_token_not_unique_per_request",
690
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
691
+ },
692
+ {
693
+ "id": "flash_based",
694
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
695
+ }
696
+ ]
697
+ },
698
+ {
699
+ "id": "application_level_denial_of_service_dos",
700
+ "children": [
701
+ {
702
+ "id": "critical_impact_and_or_easy_difficulty",
703
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
704
+ },
705
+ {
706
+ "id": "high_impact_and_or_medium_difficulty",
707
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
708
+ },
709
+ {
710
+ "id": "app_crash",
711
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
712
+ },
713
+ {
714
+ "id": "excessive_resource_consumption",
715
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
716
+ }
717
+ ]
718
+ },
719
+ {
720
+ "id": "unvalidated_redirects_and_forwards",
721
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
722
+ "children": [
723
+ {
724
+ "id": "open_redirect",
725
+ "children": [
726
+ {
727
+ "id": "get_based",
728
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
729
+ }
730
+ ]
731
+ }
732
+ ]
733
+ },
734
+ {
735
+ "id": "external_behavior",
736
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
737
+ },
738
+ {
739
+ "id": "insufficient_security_configurability",
740
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
741
+ "children": [
742
+ {
743
+ "id": "no_password_policy",
744
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
745
+ },
746
+ {
747
+ "id": "weak_password_reset_implementation",
748
+ "children": [
749
+ {
750
+ "id": "token_is_not_invalidated_after_use",
751
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
752
+ }
753
+ ]
754
+ },
755
+ {
756
+ "id": "weak_two_fa_implementation",
757
+ "children": [
758
+ {
759
+ "id": "two_fa_secret_cannot_be_rotated",
760
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
761
+ },
762
+ {
763
+ "id": "two_fa_secret_remains_obtainable_after_two_fa_is_enabled",
764
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
765
+ }
766
+ ]
767
+ }
768
+ ]
769
+ },
770
+ {
771
+ "id": "using_components_with_known_vulnerabilities",
772
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
773
+ "children": [
774
+ {
775
+ "id": "rosetta_flash",
776
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
777
+ }
778
+ ]
779
+ },
780
+ {
781
+ "id": "insecure_data_storage",
782
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
783
+ "children": [
784
+ {
785
+ "id": "sensitive_application_data_stored_unencrypted",
786
+ "children": [
787
+ {
788
+ "id": "on_external_storage",
789
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
790
+ }
791
+ ]
792
+ },
793
+ {
794
+ "id": "server_side_credentials_storage",
795
+ "children": [
796
+ {
797
+ "id": "plaintext",
798
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
799
+ }
800
+ ]
801
+ }
802
+ ]
803
+ },
804
+ {
805
+ "id": "lack_of_binary_hardening",
806
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
807
+ },
808
+ {
809
+ "id": "insecure_data_transport",
810
+ "children": [
811
+ {
812
+ "id": "cleartext_transmission_of_sensitive_data",
813
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
814
+ },
815
+ {
816
+ "id": "executable_download",
817
+ "children": [
818
+ {
819
+ "id": "no_secure_integrity_check",
820
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
821
+ },
822
+ {
823
+ "id": "secure_integrity_check",
824
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
825
+ }
826
+ ]
827
+ }
828
+ ]
829
+ },
830
+ {
831
+ "id": "physical_security_issues",
832
+ "children": [
833
+ {
834
+ "id": "bypass_of_physical_access_control",
835
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
836
+ },
837
+ {
838
+ "id": "weakness_in_physical_access_control",
839
+ "children": [
840
+ {
841
+ "id": "cloneable_key",
842
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
843
+ },
844
+ {
845
+ "id": "master_key_identification",
846
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
847
+ },
848
+ {
849
+ "id": "commonly_keyed_system",
850
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
851
+ }
852
+ ]
853
+ }
854
+ ]
855
+ },
856
+ {
857
+ "id": "insecure_os_firmware",
858
+ "children": [
859
+ {
860
+ "id": "command_injection",
861
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
862
+ },
863
+ {
864
+ "id": "hardcoded_password",
865
+ "children": [
866
+ {
867
+ "id": "privileged_user",
868
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
869
+ },
870
+ {
871
+ "id": "non_privileged_user",
872
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
873
+ }
874
+ ]
875
+ },
876
+ {
877
+ "id": "weakness_in_firmware_updates",
878
+ "children": [
879
+ {
880
+ "id": "firmware_cannot_be_updated",
881
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
882
+ },
883
+ {
884
+ "id": "firmware_does_not_validate_update_integrity",
885
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
886
+ },
887
+ {
888
+ "id": "firmware_is_not_encrypted",
889
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
890
+ }
891
+ ]
892
+ },
893
+ {
894
+ "id": "kiosk_escape_or_breakout",
895
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
896
+ },
897
+ {
898
+ "id": "poorly_configured_disk_encryption",
899
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
900
+ },
901
+ {
902
+ "id": "shared_credentials_on_storage",
903
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
904
+ },
905
+ {
906
+ "id": "over_permissioned_credentials_on_storage",
907
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
908
+ },
909
+ {
910
+ "id": "local_administrator_on_default_environment",
911
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
912
+ },
913
+ {
914
+ "id": "poorly_configured_operating_system_security",
915
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
916
+ },
917
+ {
918
+ "id": "recovery_of_disk_contains_sensitive_material",
919
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
920
+ },
921
+ {
922
+ "id": "failure_to_remove_sensitive_artifacts_from_disk",
923
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
924
+ },
925
+ {
926
+ "id": "data_not_encrypted_at_rest",
927
+ "children": [
928
+ {
929
+ "id": "non_sensitive",
930
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
931
+ },
932
+ {
933
+ "id": "sensitive",
934
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
935
+ }
936
+ ]
937
+ }
938
+ ]
939
+ },
940
+ {
941
+ "id": "cryptographic_weakness",
942
+ "children": [
943
+ {
944
+ "id": "insufficient_entropy",
945
+ "children": [
946
+ {
947
+ "id": "limited_rng_entropy_source",
948
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
949
+ },
950
+ {
951
+ "id": "use_of_trng_for_nonsecurity_purpose",
952
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
953
+ },
954
+ {
955
+ "id": "prng_seed_reuse",
956
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
957
+ },
958
+ {
959
+ "id": "predictable_prng_seed",
960
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
961
+ },
962
+ {
963
+ "id": "small_seed_space_in_prng",
964
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
965
+ },
966
+ {
967
+ "id": "initialization_vector_reuse",
968
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
969
+ },
970
+ {
971
+ "id": "predictable_initialization_vector",
972
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
973
+ }
974
+ ]
975
+ },
976
+ {
977
+ "id": "insecure_implementation",
978
+ "children": [
979
+ {
980
+ "id": "missing_cryptographic_step",
981
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
982
+ },
983
+ {
984
+ "id": "improper_following_of_specification",
985
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
986
+ }
987
+ ]
988
+ },
989
+ {
990
+ "id": "weak_hash",
991
+ "children": [
992
+ {
993
+ "id": "lack_of_salt",
994
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
995
+ },
996
+ {
997
+ "id": "use_of_predictable_salt",
998
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
999
+ },
1000
+ {
1001
+ "id": "predictable_hash_collision",
1002
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
1003
+ }
1004
+ ]
1005
+ },
1006
+ {
1007
+ "id": "insufficient_verification_of_data_authenticity",
1008
+ "children": [
1009
+ {
1010
+ "id": "identity_check_value",
1011
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1012
+ },
1013
+ {
1014
+ "id": "cryptographic_signature",
1015
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1016
+ }
1017
+ ]
1018
+ },
1019
+ {
1020
+ "id": "insecure_key_generation",
1021
+ "children": [
1022
+ {
1023
+ "id": "improper_asymmetric_prime_selection",
1024
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1025
+ },
1026
+ {
1027
+ "id": "improper_asymmetric_exponent_selection",
1028
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1029
+ },
1030
+ {
1031
+ "id": "insufficient_key_stretching",
1032
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
1033
+ },
1034
+ {
1035
+ "id": "insufficient_key_space",
1036
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
1037
+ },
1038
+ {
1039
+ "id": "key_exchange_without_entity_authentication",
1040
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1041
+ }
1042
+ ]
1043
+ },
1044
+ {
1045
+ "id": "key_reuse",
1046
+ "children": [
1047
+ {
1048
+ "id": "lack_of_perfect_forward_secrecy",
1049
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
1050
+ },
1051
+ {
1052
+ "id": "intra_environment",
1053
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
1054
+ },
1055
+ {
1056
+ "id": "inter_environment",
1057
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
1058
+ }
1059
+ ]
1060
+ },
1061
+ {
1062
+ "id": "broken_cryptography",
1063
+ "children": [
1064
+ {
1065
+ "id": "use_of_broken_cryptographic_primitive",
1066
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
1067
+ },
1068
+ {
1069
+ "id": "use_of_vulnerable_cryptographic_library",
1070
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1071
+ }
1072
+ ]
1073
+ },
1074
+ {
1075
+ "id": "side_channel_attack",
1076
+ "children": [
1077
+ {
1078
+ "id": "padding_oracle_attack",
1079
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1080
+ },
1081
+ {
1082
+ "id": "timing_attack",
1083
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1084
+ },
1085
+ {
1086
+ "id": "power_analysis_attack",
1087
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1088
+ },
1089
+ {
1090
+ "id": "emanations_attack",
1091
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1092
+ },
1093
+ {
1094
+ "id": "differential_fault_analysis",
1095
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1096
+ }
1097
+ ]
1098
+ },
1099
+ {
1100
+ "id": "use_of_expired_cryptographic_key_or_cert",
1101
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
1102
+ },
1103
+ {
1104
+ "id": "incomplete_cleanup_of_keying_material",
1105
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"
1106
+ }
1107
+ ]
1108
+ },
1109
+ {
1110
+ "id": "privacy_concerns",
1111
+ "children": [
1112
+ {
1113
+ "id": "unnecessary_data_collection",
1114
+ "children": [
1115
+ {
1116
+ "id": "wifi_ssid_password",
1117
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1118
+ }
1119
+ ]
1120
+ }
1121
+ ]
1122
+ },
1123
+ {
1124
+ "id": "network_security_misconfiguration",
1125
+ "children": [
1126
+ {
1127
+ "id": "telnet_enabled",
1128
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1129
+ }
1130
+ ]
1131
+ },
1132
+ {
1133
+ "id": "mobile_security_misconfiguration",
1134
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1135
+ "children": [
1136
+ {
1137
+ "id": "clipboard_enabled",
1138
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
1139
+ },
1140
+ {
1141
+ "id": "auto_backup_allowed_by_default",
1142
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
1143
+ }
1144
+ ]
1145
+ },
1146
+ {
1147
+ "id": "client_side_injection",
1148
+ "children": [
1149
+ {
1150
+ "id": "binary_planting",
1151
+ "children": [
1152
+ {
1153
+ "id": "privilege_escalation",
1154
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1155
+ },
1156
+ {
1157
+ "id": "non_default_folder_privilege_escalation",
1158
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
1159
+ },
1160
+ {
1161
+ "id": "no_privilege_escalation",
1162
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
1163
+ }
1164
+ ]
1165
+ }
1166
+ ]
1167
+ },
1168
+ {
1169
+ "id": "automotive_security_misconfiguration",
1170
+ "children": [
1171
+ {
1172
+ "id": "infotainment_radio_head_unit",
1173
+ "children": [
1174
+ {
1175
+ "id": "sensitive_data_leakage_exposure",
1176
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
1177
+ },
1178
+ {
1179
+ "id": "ota_firmware_manipulation",
1180
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1181
+ },
1182
+ {
1183
+ "id": "code_execution_can_bus_pivot",
1184
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
1185
+ },
1186
+ {
1187
+ "id": "code_execution_no_can_bus_pivot",
1188
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
1189
+ },
1190
+ {
1191
+ "id": "unauthorized_access_to_services",
1192
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
1193
+ },
1194
+ {
1195
+ "id": "source_code_dump",
1196
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1197
+ },
1198
+ {
1199
+ "id": "dos_brick",
1200
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1201
+ },
1202
+ {
1203
+ "id": "default_credentials",
1204
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1205
+ }
1206
+ ]
1207
+ },
1208
+ {
1209
+ "id": "rf_hub",
1210
+ "children": [
1211
+ {
1212
+ "id": "key_fob_cloning",
1213
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
1214
+ },
1215
+ {
1216
+ "id": "can_injection_interaction",
1217
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1218
+ },
1219
+ {
1220
+ "id": "data_leakage_pull_encryption_mechanism",
1221
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1222
+ },
1223
+ {
1224
+ "id": "unauthorized_access_turn_on",
1225
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
1226
+ },
1227
+ {
1228
+ "id": "roll_jam",
1229
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1230
+ },
1231
+ {
1232
+ "id": "replay",
1233
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1234
+ },
1235
+ {
1236
+ "id": "relay",
1237
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1238
+ }
1239
+ ]
1240
+ },
1241
+ {
1242
+ "id": "can",
1243
+ "children": [
1244
+ {
1245
+ "id": "injection_battery_management_system",
1246
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1247
+ },
1248
+ {
1249
+ "id": "injection_steering_control",
1250
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1251
+ },
1252
+ {
1253
+ "id": "injection_pyrotechnical_device_deployment_tool",
1254
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1255
+ },
1256
+ {
1257
+ "id": "injection_headlights",
1258
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1259
+ },
1260
+ {
1261
+ "id": "injection_sensors",
1262
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1263
+ },
1264
+ {
1265
+ "id": "injection_vehicle_anti_theft_systems",
1266
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1267
+ },
1268
+ {
1269
+ "id": "injection_powertrain",
1270
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1271
+ },
1272
+ {
1273
+ "id": "injection_basic_safety_message",
1274
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1275
+ },
1276
+ {
1277
+ "id": "injection_disallowed_messages",
1278
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
1279
+ },
1280
+ {
1281
+ "id": "injection_dos",
1282
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
1283
+ }
1284
+ ]
1285
+ },
1286
+ {
1287
+ "id": "battery_management_system",
1288
+ "children": [
1289
+ {
1290
+ "id": "firmware_dump",
1291
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
1292
+ },
1293
+ {
1294
+ "id": "fraudulent_interface",
1295
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H"
1296
+ }
1297
+ ]
1298
+ },
1299
+ {
1300
+ "id": "gnss_gps",
1301
+ "children": [
1302
+ {
1303
+ "id": "spoofing",
1304
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1305
+ }
1306
+ ]
1307
+ },
1308
+ {
1309
+ "id": "immobilizer",
1310
+ "children": [
1311
+ {
1312
+ "id": "engine_start",
1313
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1314
+ }
1315
+ ]
1316
+ },
1317
+ {
1318
+ "id": "abs",
1319
+ "children": [
1320
+ {
1321
+ "id": "unintended_acceleration_brake",
1322
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1323
+ }
1324
+ ]
1325
+ },
1326
+ {
1327
+ "id": "rsu",
1328
+ "children": [
1329
+ {
1330
+ "id": "sybil_attack",
1331
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1332
+ }
1333
+ ]
1334
+ }
1335
+ ]
1336
+ },
1337
+ {
1338
+ "id": "indicators_of_compromise",
1339
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1340
+ },
1341
+ {
1342
+ "id": "ai_application_security",
1343
+ "children": [
1344
+ {
1345
+ "id": "llm_security",
1346
+ "children": [
1347
+ {
1348
+ "id": "prompt_injection",
1349
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L"
1350
+ },
1351
+ {
1352
+ "id": "llm_output_handling",
1353
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
1354
+ },
1355
+ {
1356
+ "id": "training_data_poisoning",
1357
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
1358
+ },
1359
+ {
1360
+ "id": "excessive_agency_permission_manipulation",
1361
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
1362
+ }
1363
+ ]
1364
+ }
1365
+ ]
1366
+ }
1367
+ ]
1368
+ }