vrt 0.13.1 → 0.13.2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (13) hide show
  1. checksums.yaml +4 -4
  2. data/lib/data/1.14.2/deprecated-node-mapping.json +242 -0
  3. data/lib/data/1.14.2/mappings/cvss_v3/cvss_v3.json +1437 -0
  4. data/lib/data/1.14.2/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  5. data/lib/data/1.14.2/mappings/cwe/cwe.json +818 -0
  6. data/lib/data/1.14.2/mappings/cwe/cwe.schema.json +63 -0
  7. data/lib/data/1.14.2/mappings/remediation_advice/remediation_advice.json +2073 -0
  8. data/lib/data/1.14.2/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  9. data/lib/data/1.14.2/third-party-mappings/remediation_training/secure-code-warrior-links.json +437 -0
  10. data/lib/data/1.14.2/vrt.schema.json +63 -0
  11. data/lib/data/1.14.2/vulnerability-rating-taxonomy.json +2724 -0
  12. data/lib/vrt/version.rb +1 -1
  13. metadata +12 -2
data/lib/data/1.14.2/mappings/cvss_v3/cvss_v3.json ADDED
@@ -0,0 +1,1437 @@
1
+ {
2
+ "metadata": {
3
+ "default": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
4
+ },
5
+ "content": [
6
+ {
7
+ "id": "server_security_misconfiguration",
8
+ "children": [
9
+ {
10
+ "id": "server_side_request_forgery_ssrf",
11
+ "children": [
12
+ {
13
+ "id": "internal_high_impact",
14
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
15
+ },
16
+ {
17
+ "id": "internal_scan_and_or_medium_impact",
18
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
19
+ },
20
+ {
21
+ "id": "external_low_impact",
22
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
23
+ },
24
+ {
25
+ "id": "external_dns_query_only",
26
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
27
+ }
28
+ ]
29
+ },
30
+ {
31
+ "id": "unsafe_cross_origin_resource_sharing",
32
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
33
+ },
34
+ {
35
+ "id": "software_package_takeover",
36
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
37
+ },
38
+ {
39
+ "id": "email_verification_bypass",
40
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
41
+ },
42
+ {
43
+ "id": "missing_subresource_integrity",
44
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
45
+ },
46
+ {
47
+ "id": "request_smuggling",
48
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
49
+ },
50
+ {
51
+ "id": "path_traversal",
52
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
53
+ },
54
+ {
55
+ "id": "directory_listing_enabled",
56
+ "children": [
57
+ {
58
+ "id": "sensitive_data_exposure",
59
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
60
+ },
61
+ {
62
+ "id": "non_sensitive_data_exposure",
63
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
64
+ }
65
+ ]
66
+ },
67
+ {
68
+ "id": "same_site_scripting",
69
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
70
+ },
71
+ {
72
+ "id": "ssl_attack_breach_poodle_etc",
73
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
74
+ },
75
+ {
76
+ "id": "using_default_credentials",
77
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
78
+ },
79
+ {
80
+ "id": "misconfigured_dns",
81
+ "children": [
82
+ {
83
+ "id": "subdomain_takeover",
84
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
85
+ },
86
+ {
87
+ "id": "zone_transfer",
88
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
89
+ },
90
+ {
91
+ "id": "missing_caa_record",
92
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
93
+ }
94
+ ]
95
+ },
96
+ {
97
+ "id": "mail_server_misconfiguration",
98
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
99
+ "children": [
100
+ {
101
+ "id": "no_spoofing_protection_on_email_domain",
102
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
103
+ },
104
+ {
105
+ "id": "email_spoofing_to_inbox_due_to_missing_or_misconfigured_dmarc_on_email_domain",
106
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
107
+ }
108
+ ]
109
+ },
110
+ {
111
+ "id": "dbms_misconfiguration",
112
+ "children": [
113
+ {
114
+ "id": "excessively_privileged_user_dba",
115
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
116
+ }
117
+ ]
118
+ },
119
+ {
120
+ "id": "lack_of_password_confirmation",
121
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
122
+ "children": [
123
+ {
124
+ "id": "manage_two_fa",
125
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
126
+ }
127
+ ]
128
+ },
129
+ {
130
+ "id": "no_rate_limiting_on_form",
131
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
132
+ "children": [
133
+ {
134
+ "id": "login",
135
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
136
+ },
137
+ {
138
+ "id": "change_password",
139
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
140
+ }
141
+ ]
142
+ },
143
+ {
144
+ "id": "unsafe_file_upload",
145
+ "children": [
146
+ {
147
+ "id": "no_antivirus",
148
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
149
+ },
150
+ {
151
+ "id": "no_size_limit",
152
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
153
+ },
154
+ {
155
+ "id": "file_extension_filter_bypass",
156
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
157
+ }
158
+ ]
159
+ },
160
+ {
161
+ "id": "cookie_scoped_to_parent_domain",
162
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
163
+ },
164
+ {
165
+ "id": "missing_secure_or_httponly_cookie_flag",
166
+ "children": [
167
+ {
168
+ "id": "session_token",
169
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
170
+ },
171
+ {
172
+ "id": "non_session_cookie",
173
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
174
+ }
175
+ ]
176
+ },
177
+ {
178
+ "id": "clickjacking",
179
+ "children": [
180
+ {
181
+ "id": "sensitive_action",
182
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
183
+ },
184
+ {
185
+ "id": "form_input",
186
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
187
+ },
188
+ {
189
+ "id": "non_sensitive_action",
190
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
191
+ }
192
+ ]
193
+ },
194
+ {
195
+ "id": "oauth_misconfiguration",
196
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
197
+ "children": [
198
+ {
199
+ "id": "account_takeover",
200
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
201
+ },
202
+ {
203
+ "id": "account_squatting",
204
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
205
+ }
206
+ ]
207
+ },
208
+ {
209
+ "id": "captcha",
210
+ "children": [
211
+ {
212
+ "id": "implementation_vulnerability",
213
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
214
+ },
215
+ {
216
+ "id": "brute_force",
217
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
218
+ },
219
+ {
220
+ "id": "missing",
221
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
222
+ }
223
+ ]
224
+ },
225
+ {
226
+ "id": "exposed_admin_portal",
227
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
228
+ },
229
+ {
230
+ "id": "missing_dnssec",
231
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
232
+ },
233
+ {
234
+ "id": "fingerprinting_banner_disclosure",
235
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
236
+ },
237
+ {
238
+ "id": "username_enumeration",
239
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
240
+ },
241
+ {
242
+ "id": "potentially_unsafe_http_method_enabled",
243
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
244
+ },
245
+ {
246
+ "id": "insecure_ssl",
247
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
248
+ },
249
+ {
250
+ "id": "rfd",
251
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
252
+ },
253
+ {
254
+ "id": "lack_of_security_headers",
255
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
256
+ "children": [
257
+ {
258
+ "id": "cache_control_for_a_sensitive_page",
259
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
260
+ }
261
+ ]
262
+ },
263
+ {
264
+ "id": "waf_bypass",
265
+ "children": [
266
+ {
267
+ "id": "direct_server_access",
268
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
269
+ }
270
+ ]
271
+ },
272
+ {
273
+ "id": "race_condition",
274
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
275
+ },
276
+ {
277
+ "id": "cache_poisoning",
278
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
279
+ },
280
+ {
281
+ "id": "bitsquatting",
282
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
283
+ }
284
+ ]
285
+ },
286
+ {
287
+ "id": "server_side_injection",
288
+ "children": [
289
+ {
290
+ "id": "file_inclusion",
291
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
292
+ },
293
+ {
294
+ "id": "parameter_pollution",
295
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
296
+ },
297
+ {
298
+ "id": "remote_code_execution_rce",
299
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
300
+ },
301
+ {
302
+ "id": "ldap_injection",
303
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
304
+ },
305
+ {
306
+ "id": "sql_injection",
307
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
308
+ },
309
+ {
310
+ "id": "xml_external_entity_injection_xxe",
311
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
312
+ },
313
+ {
314
+ "id": "http_response_manipulation",
315
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
316
+ },
317
+ {
318
+ "id": "content_spoofing",
319
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
320
+ "children": [
321
+ {
322
+ "id": "iframe_injection",
323
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
324
+ },
325
+ {
326
+ "id": "impersonation_via_broken_link_hijacking",
327
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
328
+ },
329
+ {
330
+ "id": "external_authentication_injection",
331
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
332
+ },
333
+ {
334
+ "id": "flash_based_external_authentication_injection",
335
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
336
+ },
337
+ {
338
+ "id": "html_content_injection",
339
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
340
+ },
341
+ {
342
+ "id": "email_html_injection",
343
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
344
+ }
345
+ ]
346
+ },
347
+ {
348
+ "id": "ssti",
349
+ "children": [
350
+ {
351
+ "id": "basic",
352
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
353
+ },
354
+ {
355
+ "id": "custom",
356
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
357
+ }
358
+ ]
359
+ }
360
+ ]
361
+ },
362
+ {
363
+ "id": "broken_authentication_and_session_management",
364
+ "children": [
365
+ {
366
+ "id": "authentication_bypass",
367
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
368
+ },
369
+ {
370
+ "id": "two_fa_bypass",
371
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
372
+ },
373
+ {
374
+ "id": "cleartext_transmission_of_session_token",
375
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
376
+ },
377
+ {
378
+ "id": "weak_login_function",
379
+ "children": [
380
+ {
381
+ "id": "not_operational",
382
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
383
+ },
384
+ {
385
+ "id": "other_plaintext_protocol_no_secure_alternative",
386
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
387
+ },
388
+ {
389
+ "id": "over_http",
390
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
391
+ }
392
+ ]
393
+ },
394
+ {
395
+ "id": "session_fixation",
396
+ "children": [
397
+ {
398
+ "id": "remote_attack_vector",
399
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
400
+ },
401
+ {
402
+ "id": "local_attack_vector",
403
+ "cvss_v3": "AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
404
+ }
405
+ ]
406
+ },
407
+ {
408
+ "id": "failure_to_invalidate_session",
409
+ "children": [
410
+ {
411
+ "id": "on_logout",
412
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
413
+ },
414
+ {
415
+ "id": "permission_change",
416
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
417
+ },
418
+ {
419
+ "id": "on_logout_server_side_only",
420
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
421
+ },
422
+ {
423
+ "id": "on_password_change",
424
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
425
+ },
426
+ {
427
+ "id": "all_sessions",
428
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
429
+ },
430
+ {
431
+ "id": "on_email_change",
432
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
433
+ },
434
+ {
435
+ "id": "on_two_fa_activation_change",
436
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
437
+ },
438
+ {
439
+ "id": "long_timeout",
440
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
441
+ }
442
+ ]
443
+ },
444
+ {
445
+ "id": "concurrent_logins",
446
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
447
+ },
448
+ {
449
+ "id": "weak_registration_implementation",
450
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
451
+ }
452
+ ]
453
+ },
454
+ {
455
+ "id": "data_biases",
456
+ "children": [
457
+ {
458
+ "id": "representation_bias",
459
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
460
+ },
461
+ {
462
+ "id": "pre_existing_bias",
463
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
464
+ }
465
+ ]
466
+ },
467
+ {
468
+ "id": "algorithmic_biases",
469
+ "children": [
470
+ {
471
+ "id": "processing_bias",
472
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
473
+ },
474
+ {
475
+ "id": "aggregation_bias",
476
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
477
+ }
478
+ ]
479
+ },
480
+ {
481
+ "id": "societal_biases",
482
+ "children": [
483
+ {
484
+ "id": "confirmation_bias",
485
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
486
+ },
487
+ {
488
+ "id": "systemic_bias",
489
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
490
+ }
491
+ ]
492
+ },
493
+ {
494
+ "id": "misinterpretation_biases",
495
+ "children": [
496
+ {
497
+ "id": "context_ignorance",
498
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
499
+ }
500
+ ]
501
+ },
502
+ {
503
+ "id": "developer_biases",
504
+ "children": [
505
+ {
506
+ "id": "implicit_bias",
507
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N"
508
+ }
509
+ ]
510
+ },
511
+ {
512
+ "id": "sensitive_data_exposure",
513
+ "children": [
514
+ {
515
+ "id": "disclosure_of_secrets",
516
+ "children": [
517
+ {
518
+ "id": "for_publicly_accessible_asset",
519
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
520
+ },
521
+ {
522
+ "id": "pii_leakage_exposure",
523
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
524
+ },
525
+ {
526
+ "id": "for_internal_asset",
527
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
528
+ },
529
+ {
530
+ "id": "pay_per_use_abuse",
531
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
532
+ },
533
+ {
534
+ "id": "intentionally_public_sample_or_invalid",
535
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
536
+ },
537
+ {
538
+ "id": "data_traffic_spam",
539
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
540
+ },
541
+ {
542
+ "id": "non_corporate_user",
543
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
544
+ }
545
+ ]
546
+ },
547
+ {
548
+ "id": "exif_geolocation_data_not_stripped_from_uploaded_images",
549
+ "children": [
550
+ {
551
+ "id": "automatic_user_enumeration",
552
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
553
+ },
554
+ {
555
+ "id": "manual_user_enumeration",
556
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
557
+ }
558
+ ]
559
+ },
560
+ {
561
+ "id": "visible_detailed_error_page",
562
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
563
+ "children": [
564
+ {
565
+ "id": "detailed_server_configuration",
566
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
567
+ }
568
+ ]
569
+ },
570
+ {
571
+ "id": "disclosure_of_known_public_information",
572
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
573
+ },
574
+ {
575
+ "id": "token_leakage_via_referer",
576
+ "children": [
577
+ {
578
+ "id": "trusted_third_party",
579
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
580
+ },
581
+ {
582
+ "id": "untrusted_third_party",
583
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
584
+ },
585
+ {
586
+ "id": "over_http",
587
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
588
+ },
589
+ {
590
+ "id": "password_reset_token",
591
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
592
+ }
593
+ ]
594
+ },
595
+ {
596
+ "id": "sensitive_token_in_url",
597
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
598
+ },
599
+ {
600
+ "id": "non_sensitive_token_in_url",
601
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
602
+ },
603
+ {
604
+ "id": "weak_password_reset_implementation",
605
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
606
+ "children": [
607
+ {
608
+ "id": "token_leakage_via_host_header_poisoning",
609
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
610
+ }
611
+ ]
612
+ },
613
+ {
614
+ "id": "mixed_content",
615
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
616
+ },
617
+ {
618
+ "id": "sensitive_data_hardcoded",
619
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
620
+ },
621
+ {
622
+ "id": "internal_ip_disclosure",
623
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
624
+ },
625
+ {
626
+ "id": "xssi",
627
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
628
+ },
629
+ {
630
+ "id": "json_hijacking",
631
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
632
+ },
633
+ {
634
+ "id": "via_localstorage_sessionstorage",
635
+ "children": [
636
+ {
637
+ "id": "sensitive_token",
638
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
639
+ },
640
+ {
641
+ "id": "non_sensitive_token",
642
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
643
+ }
644
+ ]
645
+ }
646
+ ]
647
+ },
648
+ {
649
+ "id": "cross_site_scripting_xss",
650
+ "children": [
651
+ {
652
+ "id": "stored",
653
+ "children": [
654
+ {
655
+ "id": "non_admin_to_anyone",
656
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
657
+ },
658
+ {
659
+ "id": "privileged_user_to_privilege_elevation",
660
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
661
+ },
662
+ {
663
+ "id": "privileged_user_to_no_privilege_elevation",
664
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
665
+ },
666
+ {
667
+ "id": "url_based",
668
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
669
+ },
670
+ {
671
+ "id": "self",
672
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
673
+ }
674
+ ]
675
+ },
676
+ {
677
+ "id": "reflected",
678
+ "children": [
679
+ {
680
+ "id": "non_self",
681
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
682
+ },
683
+ {
684
+ "id": "self",
685
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
686
+ }
687
+ ]
688
+ },
689
+ {
690
+ "id": "flash_based",
691
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
692
+ },
693
+ {
694
+ "id": "cookie_based",
695
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
696
+ },
697
+ {
698
+ "id": "ie_only",
699
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
700
+ },
701
+ {
702
+ "id": "referer",
703
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
704
+ },
705
+ {
706
+ "id": "trace_method",
707
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
708
+ },
709
+ {
710
+ "id": "universal_uxss",
711
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
712
+ },
713
+ {
714
+ "id": "off_domain",
715
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
716
+ }
717
+ ]
718
+ },
719
+ {
720
+ "id": "broken_access_control",
721
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
722
+ "children": [
723
+ {
724
+ "id": "username_enumeration",
725
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
726
+ },
727
+ {
728
+ "id": "privilege_escalation",
729
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
730
+ }
731
+ ]
732
+ },
733
+ {
734
+ "id": "cross_site_request_forgery_csrf",
735
+ "children": [
736
+ {
737
+ "id": "application_wide",
738
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
739
+ },
740
+ {
741
+ "id": "action_specific",
742
+ "children": [
743
+ {
744
+ "id": "authenticated_action",
745
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
746
+ },
747
+ {
748
+ "id": "unauthenticated_action",
749
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
750
+ },
751
+ {
752
+ "id": "logout",
753
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
754
+ }
755
+ ]
756
+ },
757
+ {
758
+ "id": "csrf_token_not_unique_per_request",
759
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
760
+ },
761
+ {
762
+ "id": "flash_based",
763
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
764
+ }
765
+ ]
766
+ },
767
+ {
768
+ "id": "application_level_denial_of_service_dos",
769
+ "children": [
770
+ {
771
+ "id": "critical_impact_and_or_easy_difficulty",
772
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
773
+ },
774
+ {
775
+ "id": "high_impact_and_or_medium_difficulty",
776
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
777
+ },
778
+ {
779
+ "id": "app_crash",
780
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
781
+ },
782
+ {
783
+ "id": "excessive_resource_consumption",
784
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
785
+ }
786
+ ]
787
+ },
788
+ {
789
+ "id": "unvalidated_redirects_and_forwards",
790
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
791
+ "children": [
792
+ {
793
+ "id": "open_redirect",
794
+ "children": [
795
+ {
796
+ "id": "get_based",
797
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
798
+ }
799
+ ]
800
+ }
801
+ ]
802
+ },
803
+ {
804
+ "id": "external_behavior",
805
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
806
+ },
807
+ {
808
+ "id": "insufficient_security_configurability",
809
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
810
+ "children": [
811
+ {
812
+ "id": "no_password_policy",
813
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
814
+ },
815
+ {
816
+ "id": "weak_password_reset_implementation",
817
+ "children": [
818
+ {
819
+ "id": "token_is_not_invalidated_after_use",
820
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
821
+ }
822
+ ]
823
+ },
824
+ {
825
+ "id": "weak_two_fa_implementation",
826
+ "children": [
827
+ {
828
+ "id": "two_fa_secret_cannot_be_rotated",
829
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
830
+ },
831
+ {
832
+ "id": "two_fa_secret_remains_obtainable_after_two_fa_is_enabled",
833
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
834
+ }
835
+ ]
836
+ }
837
+ ]
838
+ },
839
+ {
840
+ "id": "using_components_with_known_vulnerabilities",
841
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
842
+ "children": [
843
+ {
844
+ "id": "rosetta_flash",
845
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
846
+ }
847
+ ]
848
+ },
849
+ {
850
+ "id": "insecure_data_storage",
851
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
852
+ "children": [
853
+ {
854
+ "id": "sensitive_application_data_stored_unencrypted",
855
+ "children": [
856
+ {
857
+ "id": "on_external_storage",
858
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
859
+ }
860
+ ]
861
+ },
862
+ {
863
+ "id": "server_side_credentials_storage",
864
+ "children": [
865
+ {
866
+ "id": "plaintext",
867
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
868
+ }
869
+ ]
870
+ }
871
+ ]
872
+ },
873
+ {
874
+ "id": "lack_of_binary_hardening",
875
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
876
+ },
877
+ {
878
+ "id": "insecure_data_transport",
879
+ "children": [
880
+ {
881
+ "id": "cleartext_transmission_of_sensitive_data",
882
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
883
+ },
884
+ {
885
+ "id": "executable_download",
886
+ "children": [
887
+ {
888
+ "id": "no_secure_integrity_check",
889
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
890
+ },
891
+ {
892
+ "id": "secure_integrity_check",
893
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
894
+ }
895
+ ]
896
+ }
897
+ ]
898
+ },
899
+ {
900
+ "id": "physical_security_issues",
901
+ "children": [
902
+ {
903
+ "id": "bypass_of_physical_access_control",
904
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
905
+ },
906
+ {
907
+ "id": "weakness_in_physical_access_control",
908
+ "children": [
909
+ {
910
+ "id": "cloneable_key",
911
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
912
+ },
913
+ {
914
+ "id": "master_key_identification",
915
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
916
+ },
917
+ {
918
+ "id": "commonly_keyed_system",
919
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
920
+ }
921
+ ]
922
+ }
923
+ ]
924
+ },
925
+ {
926
+ "id": "insecure_os_firmware",
927
+ "children": [
928
+ {
929
+ "id": "command_injection",
930
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
931
+ },
932
+ {
933
+ "id": "hardcoded_password",
934
+ "children": [
935
+ {
936
+ "id": "privileged_user",
937
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
938
+ },
939
+ {
940
+ "id": "non_privileged_user",
941
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
942
+ }
943
+ ]
944
+ },
945
+ {
946
+ "id": "weakness_in_firmware_updates",
947
+ "children": [
948
+ {
949
+ "id": "firmware_cannot_be_updated",
950
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
951
+ },
952
+ {
953
+ "id": "firmware_does_not_validate_update_integrity",
954
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
955
+ },
956
+ {
957
+ "id": "firmware_is_not_encrypted",
958
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
959
+ }
960
+ ]
961
+ },
962
+ {
963
+ "id": "kiosk_escape_or_breakout",
964
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
965
+ },
966
+ {
967
+ "id": "poorly_configured_disk_encryption",
968
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
969
+ },
970
+ {
971
+ "id": "shared_credentials_on_storage",
972
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
973
+ },
974
+ {
975
+ "id": "over_permissioned_credentials_on_storage",
976
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
977
+ },
978
+ {
979
+ "id": "local_administrator_on_default_environment",
980
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
981
+ },
982
+ {
983
+ "id": "poorly_configured_operating_system_security",
984
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
985
+ },
986
+ {
987
+ "id": "recovery_of_disk_contains_sensitive_material",
988
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
989
+ },
990
+ {
991
+ "id": "failure_to_remove_sensitive_artifacts_from_disk",
992
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
993
+ },
994
+ {
995
+ "id": "data_not_encrypted_at_rest",
996
+ "children": [
997
+ {
998
+ "id": "non_sensitive",
999
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1000
+ },
1001
+ {
1002
+ "id": "sensitive",
1003
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
1004
+ }
1005
+ ]
1006
+ }
1007
+ ]
1008
+ },
1009
+ {
1010
+ "id": "cryptographic_weakness",
1011
+ "children": [
1012
+ {
1013
+ "id": "insufficient_entropy",
1014
+ "children": [
1015
+ {
1016
+ "id": "limited_rng_entropy_source",
1017
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
1018
+ },
1019
+ {
1020
+ "id": "use_of_trng_for_nonsecurity_purpose",
1021
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
1022
+ },
1023
+ {
1024
+ "id": "prng_seed_reuse",
1025
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
1026
+ },
1027
+ {
1028
+ "id": "predictable_prng_seed",
1029
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
1030
+ },
1031
+ {
1032
+ "id": "small_seed_space_in_prng",
1033
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
1034
+ },
1035
+ {
1036
+ "id": "initialization_vector_reuse",
1037
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
1038
+ },
1039
+ {
1040
+ "id": "predictable_initialization_vector",
1041
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
1042
+ }
1043
+ ]
1044
+ },
1045
+ {
1046
+ "id": "insecure_implementation",
1047
+ "children": [
1048
+ {
1049
+ "id": "missing_cryptographic_step",
1050
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
1051
+ },
1052
+ {
1053
+ "id": "improper_following_of_specification",
1054
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
1055
+ }
1056
+ ]
1057
+ },
1058
+ {
1059
+ "id": "weak_hash",
1060
+ "children": [
1061
+ {
1062
+ "id": "lack_of_salt",
1063
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
1064
+ },
1065
+ {
1066
+ "id": "use_of_predictable_salt",
1067
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
1068
+ },
1069
+ {
1070
+ "id": "predictable_hash_collision",
1071
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
1072
+ }
1073
+ ]
1074
+ },
1075
+ {
1076
+ "id": "insufficient_verification_of_data_authenticity",
1077
+ "children": [
1078
+ {
1079
+ "id": "identity_check_value",
1080
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1081
+ },
1082
+ {
1083
+ "id": "cryptographic_signature",
1084
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1085
+ }
1086
+ ]
1087
+ },
1088
+ {
1089
+ "id": "insecure_key_generation",
1090
+ "children": [
1091
+ {
1092
+ "id": "improper_asymmetric_prime_selection",
1093
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1094
+ },
1095
+ {
1096
+ "id": "improper_asymmetric_exponent_selection",
1097
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1098
+ },
1099
+ {
1100
+ "id": "insufficient_key_stretching",
1101
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
1102
+ },
1103
+ {
1104
+ "id": "insufficient_key_space",
1105
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
1106
+ },
1107
+ {
1108
+ "id": "key_exchange_without_entity_authentication",
1109
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1110
+ }
1111
+ ]
1112
+ },
1113
+ {
1114
+ "id": "key_reuse",
1115
+ "children": [
1116
+ {
1117
+ "id": "lack_of_perfect_forward_secrecy",
1118
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
1119
+ },
1120
+ {
1121
+ "id": "intra_environment",
1122
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
1123
+ },
1124
+ {
1125
+ "id": "inter_environment",
1126
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
1127
+ }
1128
+ ]
1129
+ },
1130
+ {
1131
+ "id": "broken_cryptography",
1132
+ "children": [
1133
+ {
1134
+ "id": "use_of_broken_cryptographic_primitive",
1135
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
1136
+ },
1137
+ {
1138
+ "id": "use_of_vulnerable_cryptographic_library",
1139
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
1140
+ }
1141
+ ]
1142
+ },
1143
+ {
1144
+ "id": "side_channel_attack",
1145
+ "children": [
1146
+ {
1147
+ "id": "padding_oracle_attack",
1148
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1149
+ },
1150
+ {
1151
+ "id": "timing_attack",
1152
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1153
+ },
1154
+ {
1155
+ "id": "power_analysis_attack",
1156
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1157
+ },
1158
+ {
1159
+ "id": "emanations_attack",
1160
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1161
+ },
1162
+ {
1163
+ "id": "differential_fault_analysis",
1164
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1165
+ }
1166
+ ]
1167
+ },
1168
+ {
1169
+ "id": "use_of_expired_cryptographic_key_or_cert",
1170
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
1171
+ },
1172
+ {
1173
+ "id": "incomplete_cleanup_of_keying_material",
1174
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"
1175
+ }
1176
+ ]
1177
+ },
1178
+ {
1179
+ "id": "privacy_concerns",
1180
+ "children": [
1181
+ {
1182
+ "id": "unnecessary_data_collection",
1183
+ "children": [
1184
+ {
1185
+ "id": "wifi_ssid_password",
1186
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1187
+ }
1188
+ ]
1189
+ }
1190
+ ]
1191
+ },
1192
+ {
1193
+ "id": "network_security_misconfiguration",
1194
+ "children": [
1195
+ {
1196
+ "id": "telnet_enabled",
1197
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1198
+ }
1199
+ ]
1200
+ },
1201
+ {
1202
+ "id": "mobile_security_misconfiguration",
1203
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1204
+ "children": [
1205
+ {
1206
+ "id": "clipboard_enabled",
1207
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
1208
+ },
1209
+ {
1210
+ "id": "auto_backup_allowed_by_default",
1211
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
1212
+ }
1213
+ ]
1214
+ },
1215
+ {
1216
+ "id": "client_side_injection",
1217
+ "children": [
1218
+ {
1219
+ "id": "binary_planting",
1220
+ "children": [
1221
+ {
1222
+ "id": "privilege_escalation",
1223
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
1224
+ },
1225
+ {
1226
+ "id": "non_default_folder_privilege_escalation",
1227
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
1228
+ },
1229
+ {
1230
+ "id": "no_privilege_escalation",
1231
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
1232
+ }
1233
+ ]
1234
+ }
1235
+ ]
1236
+ },
1237
+ {
1238
+ "id": "automotive_security_misconfiguration",
1239
+ "children": [
1240
+ {
1241
+ "id": "infotainment_radio_head_unit",
1242
+ "children": [
1243
+ {
1244
+ "id": "sensitive_data_leakage_exposure",
1245
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
1246
+ },
1247
+ {
1248
+ "id": "ota_firmware_manipulation",
1249
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1250
+ },
1251
+ {
1252
+ "id": "code_execution_can_bus_pivot",
1253
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
1254
+ },
1255
+ {
1256
+ "id": "code_execution_no_can_bus_pivot",
1257
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
1258
+ },
1259
+ {
1260
+ "id": "unauthorized_access_to_services",
1261
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
1262
+ },
1263
+ {
1264
+ "id": "source_code_dump",
1265
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1266
+ },
1267
+ {
1268
+ "id": "dos_brick",
1269
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1270
+ },
1271
+ {
1272
+ "id": "default_credentials",
1273
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1274
+ }
1275
+ ]
1276
+ },
1277
+ {
1278
+ "id": "rf_hub",
1279
+ "children": [
1280
+ {
1281
+ "id": "key_fob_cloning",
1282
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
1283
+ },
1284
+ {
1285
+ "id": "can_injection_interaction",
1286
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1287
+ },
1288
+ {
1289
+ "id": "data_leakage_pull_encryption_mechanism",
1290
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
1291
+ },
1292
+ {
1293
+ "id": "unauthorized_access_turn_on",
1294
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
1295
+ },
1296
+ {
1297
+ "id": "roll_jam",
1298
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1299
+ },
1300
+ {
1301
+ "id": "replay",
1302
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1303
+ },
1304
+ {
1305
+ "id": "relay",
1306
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1307
+ }
1308
+ ]
1309
+ },
1310
+ {
1311
+ "id": "can",
1312
+ "children": [
1313
+ {
1314
+ "id": "injection_battery_management_system",
1315
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1316
+ },
1317
+ {
1318
+ "id": "injection_steering_control",
1319
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1320
+ },
1321
+ {
1322
+ "id": "injection_pyrotechnical_device_deployment_tool",
1323
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1324
+ },
1325
+ {
1326
+ "id": "injection_headlights",
1327
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1328
+ },
1329
+ {
1330
+ "id": "injection_sensors",
1331
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1332
+ },
1333
+ {
1334
+ "id": "injection_vehicle_anti_theft_systems",
1335
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1336
+ },
1337
+ {
1338
+ "id": "injection_powertrain",
1339
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1340
+ },
1341
+ {
1342
+ "id": "injection_basic_safety_message",
1343
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1344
+ },
1345
+ {
1346
+ "id": "injection_disallowed_messages",
1347
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
1348
+ },
1349
+ {
1350
+ "id": "injection_dos",
1351
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
1352
+ }
1353
+ ]
1354
+ },
1355
+ {
1356
+ "id": "battery_management_system",
1357
+ "children": [
1358
+ {
1359
+ "id": "firmware_dump",
1360
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
1361
+ },
1362
+ {
1363
+ "id": "fraudulent_interface",
1364
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H"
1365
+ }
1366
+ ]
1367
+ },
1368
+ {
1369
+ "id": "gnss_gps",
1370
+ "children": [
1371
+ {
1372
+ "id": "spoofing",
1373
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1374
+ }
1375
+ ]
1376
+ },
1377
+ {
1378
+ "id": "immobilizer",
1379
+ "children": [
1380
+ {
1381
+ "id": "engine_start",
1382
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1383
+ }
1384
+ ]
1385
+ },
1386
+ {
1387
+ "id": "abs",
1388
+ "children": [
1389
+ {
1390
+ "id": "unintended_acceleration_brake",
1391
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1392
+ }
1393
+ ]
1394
+ },
1395
+ {
1396
+ "id": "rsu",
1397
+ "children": [
1398
+ {
1399
+ "id": "sybil_attack",
1400
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
1401
+ }
1402
+ ]
1403
+ }
1404
+ ]
1405
+ },
1406
+ {
1407
+ "id": "indicators_of_compromise",
1408
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1409
+ },
1410
+ {
1411
+ "id": "ai_application_security",
1412
+ "children": [
1413
+ {
1414
+ "id": "llm_security",
1415
+ "children": [
1416
+ {
1417
+ "id": "prompt_injection",
1418
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L"
1419
+ },
1420
+ {
1421
+ "id": "llm_output_handling",
1422
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
1423
+ },
1424
+ {
1425
+ "id": "training_data_poisoning",
1426
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
1427
+ },
1428
+ {
1429
+ "id": "excessive_agency_permission_manipulation",
1430
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
1431
+ }
1432
+ ]
1433
+ }
1434
+ ]
1435
+ }
1436
+ ]
1437
+ }