vrt 0.13.2 → 0.13.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (13) hide show
  1. checksums.yaml +4 -4
  2. data/lib/data/1.15/deprecated-node-mapping.json +257 -0
  3. data/lib/data/1.15/mappings/cvss_v3/cvss_v3.json +1461 -0
  4. data/lib/data/1.15/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  5. data/lib/data/1.15/mappings/cwe/cwe.json +1161 -0
  6. data/lib/data/1.15/mappings/cwe/cwe.schema.json +63 -0
  7. data/lib/data/1.15/mappings/remediation_advice/remediation_advice.json +2115 -0
  8. data/lib/data/1.15/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  9. data/lib/data/1.15/third-party-mappings/remediation_training/secure-code-warrior-links.json +490 -0
  10. data/lib/data/1.15/vrt.schema.json +63 -0
  11. data/lib/data/1.15/vulnerability-rating-taxonomy.json +3052 -0
  12. data/lib/vrt/version.rb +1 -1
  13. metadata +12 -2
data/lib/data/1.15/mappings/cvss_v3/cvss_v3.json ADDED
@@ -0,0 +1,1461 @@
1
+ {
2
+ "metadata": {
3
+ "default": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
4
+ },
5
+ "content": [
6
+ {
7
+ "id": "ai_application_security",
8
+ "children": [
9
+ {
10
+ "id": "llm_security",
11
+ "children": [
12
+ {
13
+ "id": "excessive_agency_permission_manipulation",
14
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
15
+ },
16
+ {
17
+ "id": "llm_output_handling",
18
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
19
+ },
20
+ {
21
+ "id": "prompt_injection",
22
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L"
23
+ },
24
+ {
25
+ "id": "training_data_poisoning",
26
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
27
+ }
28
+ ]
29
+ }
30
+ ]
31
+ },
32
+ {
33
+ "id": "algorithmic_biases",
34
+ "children": [
35
+ {
36
+ "id": "aggregation_bias",
37
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
38
+ },
39
+ {
40
+ "id": "processing_bias",
41
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
42
+ }
43
+ ]
44
+ },
45
+ {
46
+ "id": "application_level_denial_of_service_dos",
47
+ "children": [
48
+ {
49
+ "id": "app_crash",
50
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
51
+ },
52
+ {
53
+ "id": "critical_impact_and_or_easy_difficulty",
54
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
55
+ },
56
+ {
57
+ "id": "excessive_resource_consumption",
58
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
59
+ },
60
+ {
61
+ "id": "high_impact_and_or_medium_difficulty",
62
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
63
+ }
64
+ ]
65
+ },
66
+ {
67
+ "id": "automotive_security_misconfiguration",
68
+ "children": [
69
+ {
70
+ "id": "abs",
71
+ "children": [
72
+ {
73
+ "id": "unintended_acceleration_brake",
74
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
75
+ }
76
+ ]
77
+ },
78
+ {
79
+ "id": "battery_management_system",
80
+ "children": [
81
+ {
82
+ "id": "firmware_dump",
83
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
84
+ },
85
+ {
86
+ "id": "fraudulent_interface",
87
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H"
88
+ }
89
+ ]
90
+ },
91
+ {
92
+ "id": "can",
93
+ "children": [
94
+ {
95
+ "id": "injection_basic_safety_message",
96
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
97
+ },
98
+ {
99
+ "id": "injection_battery_management_system",
100
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
101
+ },
102
+ {
103
+ "id": "injection_disallowed_messages",
104
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
105
+ },
106
+ {
107
+ "id": "injection_dos",
108
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
109
+ },
110
+ {
111
+ "id": "injection_headlights",
112
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
113
+ },
114
+ {
115
+ "id": "injection_powertrain",
116
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
117
+ },
118
+ {
119
+ "id": "injection_pyrotechnical_device_deployment_tool",
120
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
121
+ },
122
+ {
123
+ "id": "injection_sensors",
124
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
125
+ },
126
+ {
127
+ "id": "injection_steering_control",
128
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
129
+ },
130
+ {
131
+ "id": "injection_vehicle_anti_theft_systems",
132
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
133
+ }
134
+ ]
135
+ },
136
+ {
137
+ "id": "gnss_gps",
138
+ "children": [
139
+ {
140
+ "id": "spoofing",
141
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
142
+ }
143
+ ]
144
+ },
145
+ {
146
+ "id": "immobilizer",
147
+ "children": [
148
+ {
149
+ "id": "engine_start",
150
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
151
+ }
152
+ ]
153
+ },
154
+ {
155
+ "id": "infotainment_radio_head_unit",
156
+ "children": [
157
+ {
158
+ "id": "code_execution_can_bus_pivot",
159
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
160
+ },
161
+ {
162
+ "id": "code_execution_no_can_bus_pivot",
163
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
164
+ },
165
+ {
166
+ "id": "default_credentials",
167
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
168
+ },
169
+ {
170
+ "id": "dos_brick",
171
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
172
+ },
173
+ {
174
+ "id": "ota_firmware_manipulation",
175
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
176
+ },
177
+ {
178
+ "id": "sensitive_data_leakage_exposure",
179
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
180
+ },
181
+ {
182
+ "id": "source_code_dump",
183
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
184
+ },
185
+ {
186
+ "id": "unauthorized_access_to_services",
187
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
188
+ }
189
+ ]
190
+ },
191
+ {
192
+ "id": "rf_hub",
193
+ "children": [
194
+ {
195
+ "id": "can_injection_interaction",
196
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
197
+ },
198
+ {
199
+ "id": "data_leakage_pull_encryption_mechanism",
200
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
201
+ },
202
+ {
203
+ "id": "key_fob_cloning",
204
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
205
+ },
206
+ {
207
+ "id": "relay",
208
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
209
+ },
210
+ {
211
+ "id": "replay",
212
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
213
+ },
214
+ {
215
+ "id": "roll_jam",
216
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
217
+ },
218
+ {
219
+ "id": "unauthorized_access_turn_on",
220
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
221
+ }
222
+ ]
223
+ },
224
+ {
225
+ "id": "rsu",
226
+ "children": [
227
+ {
228
+ "id": "sybil_attack",
229
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
230
+ }
231
+ ]
232
+ }
233
+ ]
234
+ },
235
+ {
236
+ "id": "blockchain_infrastructure_misconfiguration",
237
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
238
+ },
239
+ {
240
+ "id": "broken_access_control",
241
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
242
+ "children": [
243
+ {
244
+ "id": "privilege_escalation",
245
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
246
+ },
247
+ {
248
+ "id": "username_enumeration",
249
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
250
+ }
251
+ ]
252
+ },
253
+ {
254
+ "id": "broken_authentication_and_session_management",
255
+ "children": [
256
+ {
257
+ "id": "authentication_bypass",
258
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
259
+ },
260
+ {
261
+ "id": "cleartext_transmission_of_session_token",
262
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
263
+ },
264
+ {
265
+ "id": "concurrent_logins",
266
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
267
+ },
268
+ {
269
+ "id": "failure_to_invalidate_session",
270
+ "children": [
271
+ {
272
+ "id": "all_sessions",
273
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
274
+ },
275
+ {
276
+ "id": "long_timeout",
277
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
278
+ },
279
+ {
280
+ "id": "on_email_change",
281
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
282
+ },
283
+ {
284
+ "id": "on_logout",
285
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
286
+ },
287
+ {
288
+ "id": "on_logout_server_side_only",
289
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
290
+ },
291
+ {
292
+ "id": "on_password_change",
293
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
294
+ },
295
+ {
296
+ "id": "on_two_fa_activation_change",
297
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
298
+ },
299
+ {
300
+ "id": "permission_change",
301
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
302
+ }
303
+ ]
304
+ },
305
+ {
306
+ "id": "saml_replay",
307
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
308
+ },
309
+ {
310
+ "id": "session_fixation",
311
+ "children": [
312
+ {
313
+ "id": "local_attack_vector",
314
+ "cvss_v3": "AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
315
+ },
316
+ {
317
+ "id": "remote_attack_vector",
318
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
319
+ }
320
+ ]
321
+ },
322
+ {
323
+ "id": "two_fa_bypass",
324
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
325
+ },
326
+ {
327
+ "id": "weak_login_function",
328
+ "children": [
329
+ {
330
+ "id": "not_operational",
331
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
332
+ },
333
+ {
334
+ "id": "other_plaintext_protocol_no_secure_alternative",
335
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
336
+ },
337
+ {
338
+ "id": "over_http",
339
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
340
+ }
341
+ ]
342
+ },
343
+ {
344
+ "id": "weak_registration_implementation",
345
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
346
+ }
347
+ ]
348
+ },
349
+ {
350
+ "id": "client_side_injection",
351
+ "children": [
352
+ {
353
+ "id": "binary_planting",
354
+ "children": [
355
+ {
356
+ "id": "no_privilege_escalation",
357
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
358
+ },
359
+ {
360
+ "id": "non_default_folder_privilege_escalation",
361
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
362
+ },
363
+ {
364
+ "id": "privilege_escalation",
365
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
366
+ }
367
+ ]
368
+ }
369
+ ]
370
+ },
371
+ {
372
+ "id": "cross_site_request_forgery_csrf",
373
+ "children": [
374
+ {
375
+ "id": "action_specific",
376
+ "children": [
377
+ {
378
+ "id": "authenticated_action",
379
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
380
+ },
381
+ {
382
+ "id": "logout",
383
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
384
+ },
385
+ {
386
+ "id": "unauthenticated_action",
387
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
388
+ }
389
+ ]
390
+ },
391
+ {
392
+ "id": "application_wide",
393
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
394
+ },
395
+ {
396
+ "id": "csrf_token_not_unique_per_request",
397
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
398
+ },
399
+ {
400
+ "id": "flash_based",
401
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
402
+ }
403
+ ]
404
+ },
405
+ {
406
+ "id": "cross_site_scripting_xss",
407
+ "children": [
408
+ {
409
+ "id": "cookie_based",
410
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
411
+ },
412
+ {
413
+ "id": "flash_based",
414
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
415
+ },
416
+ {
417
+ "id": "ie_only",
418
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
419
+ },
420
+ {
421
+ "id": "off_domain",
422
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
423
+ },
424
+ {
425
+ "id": "referer",
426
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
427
+ },
428
+ {
429
+ "id": "reflected",
430
+ "children": [
431
+ {
432
+ "id": "non_self",
433
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
434
+ },
435
+ {
436
+ "id": "self",
437
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
438
+ }
439
+ ]
440
+ },
441
+ {
442
+ "id": "stored",
443
+ "children": [
444
+ {
445
+ "id": "non_admin_to_anyone",
446
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
447
+ },
448
+ {
449
+ "id": "privileged_user_to_no_privilege_elevation",
450
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
451
+ },
452
+ {
453
+ "id": "privileged_user_to_privilege_elevation",
454
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
455
+ },
456
+ {
457
+ "id": "self",
458
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
459
+ },
460
+ {
461
+ "id": "url_based",
462
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
463
+ }
464
+ ]
465
+ },
466
+ {
467
+ "id": "trace_method",
468
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
469
+ },
470
+ {
471
+ "id": "universal_uxss",
472
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
473
+ }
474
+ ]
475
+ },
476
+ {
477
+ "id": "cryptographic_weakness",
478
+ "children": [
479
+ {
480
+ "id": "broken_cryptography",
481
+ "children": [
482
+ {
483
+ "id": "use_of_broken_cryptographic_primitive",
484
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
485
+ },
486
+ {
487
+ "id": "use_of_vulnerable_cryptographic_library",
488
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
489
+ }
490
+ ]
491
+ },
492
+ {
493
+ "id": "incomplete_cleanup_of_keying_material",
494
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"
495
+ },
496
+ {
497
+ "id": "insecure_implementation",
498
+ "children": [
499
+ {
500
+ "id": "improper_following_of_specification",
501
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
502
+ },
503
+ {
504
+ "id": "missing_cryptographic_step",
505
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
506
+ }
507
+ ]
508
+ },
509
+ {
510
+ "id": "insecure_key_generation",
511
+ "children": [
512
+ {
513
+ "id": "improper_asymmetric_exponent_selection",
514
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
515
+ },
516
+ {
517
+ "id": "improper_asymmetric_prime_selection",
518
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
519
+ },
520
+ {
521
+ "id": "insufficient_key_space",
522
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
523
+ },
524
+ {
525
+ "id": "insufficient_key_stretching",
526
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
527
+ },
528
+ {
529
+ "id": "key_exchange_without_entity_authentication",
530
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
531
+ }
532
+ ]
533
+ },
534
+ {
535
+ "id": "insufficient_entropy",
536
+ "children": [
537
+ {
538
+ "id": "initialization_vector_reuse",
539
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
540
+ },
541
+ {
542
+ "id": "limited_rng_entropy_source",
543
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
544
+ },
545
+ {
546
+ "id": "predictable_initialization_vector",
547
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
548
+ },
549
+ {
550
+ "id": "predictable_prng_seed",
551
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
552
+ },
553
+ {
554
+ "id": "prng_seed_reuse",
555
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
556
+ },
557
+ {
558
+ "id": "small_seed_space_in_prng",
559
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
560
+ },
561
+ {
562
+ "id": "use_of_trng_for_nonsecurity_purpose",
563
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
564
+ }
565
+ ]
566
+ },
567
+ {
568
+ "id": "insufficient_verification_of_data_authenticity",
569
+ "children": [
570
+ {
571
+ "id": "cryptographic_signature",
572
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
573
+ },
574
+ {
575
+ "id": "identity_check_value",
576
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
577
+ }
578
+ ]
579
+ },
580
+ {
581
+ "id": "key_reuse",
582
+ "children": [
583
+ {
584
+ "id": "inter_environment",
585
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
586
+ },
587
+ {
588
+ "id": "intra_environment",
589
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
590
+ },
591
+ {
592
+ "id": "lack_of_perfect_forward_secrecy",
593
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
594
+ }
595
+ ]
596
+ },
597
+ {
598
+ "id": "side_channel_attack",
599
+ "children": [
600
+ {
601
+ "id": "differential_fault_analysis",
602
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
603
+ },
604
+ {
605
+ "id": "emanations_attack",
606
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
607
+ },
608
+ {
609
+ "id": "padding_oracle_attack",
610
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
611
+ },
612
+ {
613
+ "id": "power_analysis_attack",
614
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
615
+ },
616
+ {
617
+ "id": "timing_attack",
618
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
619
+ }
620
+ ]
621
+ },
622
+ {
623
+ "id": "use_of_expired_cryptographic_key_or_cert",
624
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
625
+ },
626
+ {
627
+ "id": "weak_hash",
628
+ "children": [
629
+ {
630
+ "id": "lack_of_salt",
631
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
632
+ },
633
+ {
634
+ "id": "predictable_hash_collision",
635
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
636
+ },
637
+ {
638
+ "id": "use_of_predictable_salt",
639
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
640
+ }
641
+ ]
642
+ }
643
+ ]
644
+ },
645
+ {
646
+ "id": "data_biases",
647
+ "children": [
648
+ {
649
+ "id": "pre_existing_bias",
650
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
651
+ },
652
+ {
653
+ "id": "representation_bias",
654
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
655
+ }
656
+ ]
657
+ },
658
+ {
659
+ "id": "decentralized_application_misconfiguration",
660
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
661
+ },
662
+ {
663
+ "id": "developer_biases",
664
+ "children": [
665
+ {
666
+ "id": "implicit_bias",
667
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N"
668
+ }
669
+ ]
670
+ },
671
+ {
672
+ "id": "external_behavior",
673
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
674
+ },
675
+ {
676
+ "id": "indicators_of_compromise",
677
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
678
+ },
679
+ {
680
+ "id": "insecure_data_storage",
681
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
682
+ "children": [
683
+ {
684
+ "id": "sensitive_application_data_stored_unencrypted",
685
+ "children": [
686
+ {
687
+ "id": "on_external_storage",
688
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
689
+ }
690
+ ]
691
+ },
692
+ {
693
+ "id": "server_side_credentials_storage",
694
+ "children": [
695
+ {
696
+ "id": "plaintext",
697
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
698
+ }
699
+ ]
700
+ }
701
+ ]
702
+ },
703
+ {
704
+ "id": "insecure_data_transport",
705
+ "children": [
706
+ {
707
+ "id": "cleartext_transmission_of_sensitive_data",
708
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
709
+ },
710
+ {
711
+ "id": "executable_download",
712
+ "children": [
713
+ {
714
+ "id": "no_secure_integrity_check",
715
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
716
+ },
717
+ {
718
+ "id": "secure_integrity_check",
719
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
720
+ }
721
+ ]
722
+ }
723
+ ]
724
+ },
725
+ {
726
+ "id": "insecure_os_firmware",
727
+ "children": [
728
+ {
729
+ "id": "command_injection",
730
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
731
+ },
732
+ {
733
+ "id": "data_not_encrypted_at_rest",
734
+ "children": [
735
+ {
736
+ "id": "non_sensitive",
737
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
738
+ },
739
+ {
740
+ "id": "sensitive",
741
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
742
+ }
743
+ ]
744
+ },
745
+ {
746
+ "id": "failure_to_remove_sensitive_artifacts_from_disk",
747
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
748
+ },
749
+ {
750
+ "id": "hardcoded_password",
751
+ "children": [
752
+ {
753
+ "id": "non_privileged_user",
754
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
755
+ },
756
+ {
757
+ "id": "privileged_user",
758
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
759
+ }
760
+ ]
761
+ },
762
+ {
763
+ "id": "kiosk_escape_or_breakout",
764
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
765
+ },
766
+ {
767
+ "id": "local_administrator_on_default_environment",
768
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
769
+ },
770
+ {
771
+ "id": "over_permissioned_credentials_on_storage",
772
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
773
+ },
774
+ {
775
+ "id": "poorly_configured_disk_encryption",
776
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
777
+ },
778
+ {
779
+ "id": "poorly_configured_operating_system_security",
780
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
781
+ },
782
+ {
783
+ "id": "recovery_of_disk_contains_sensitive_material",
784
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
785
+ },
786
+ {
787
+ "id": "shared_credentials_on_storage",
788
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
789
+ },
790
+ {
791
+ "id": "weakness_in_firmware_updates",
792
+ "children": [
793
+ {
794
+ "id": "firmware_cannot_be_updated",
795
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
796
+ },
797
+ {
798
+ "id": "firmware_does_not_validate_update_integrity",
799
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
800
+ },
801
+ {
802
+ "id": "firmware_is_not_encrypted",
803
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
804
+ }
805
+ ]
806
+ }
807
+ ]
808
+ },
809
+ {
810
+ "id": "insufficient_security_configurability",
811
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
812
+ "children": [
813
+ {
814
+ "id": "no_password_policy",
815
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
816
+ },
817
+ {
818
+ "id": "weak_password_reset_implementation",
819
+ "children": [
820
+ {
821
+ "id": "token_is_not_invalidated_after_use",
822
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
823
+ }
824
+ ]
825
+ },
826
+ {
827
+ "id": "weak_two_fa_implementation",
828
+ "children": [
829
+ {
830
+ "id": "two_fa_secret_cannot_be_rotated",
831
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
832
+ },
833
+ {
834
+ "id": "two_fa_secret_remains_obtainable_after_two_fa_is_enabled",
835
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
836
+ }
837
+ ]
838
+ }
839
+ ]
840
+ },
841
+ {
842
+ "id": "lack_of_binary_hardening",
843
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
844
+ },
845
+ {
846
+ "id": "misinterpretation_biases",
847
+ "children": [
848
+ {
849
+ "id": "context_ignorance",
850
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
851
+ }
852
+ ]
853
+ },
854
+ {
855
+ "id": "mobile_security_misconfiguration",
856
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
857
+ "children": [
858
+ {
859
+ "id": "auto_backup_allowed_by_default",
860
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
861
+ },
862
+ {
863
+ "id": "clipboard_enabled",
864
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
865
+ }
866
+ ]
867
+ },
868
+ {
869
+ "id": "network_security_misconfiguration",
870
+ "children": [
871
+ {
872
+ "id": "telnet_enabled",
873
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
874
+ }
875
+ ]
876
+ },
877
+ {
878
+ "id": "physical_security_issues",
879
+ "children": [
880
+ {
881
+ "id": "bypass_of_physical_access_control",
882
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
883
+ },
884
+ {
885
+ "id": "weakness_in_physical_access_control",
886
+ "children": [
887
+ {
888
+ "id": "cloneable_key",
889
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
890
+ },
891
+ {
892
+ "id": "commonly_keyed_system",
893
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
894
+ },
895
+ {
896
+ "id": "master_key_identification",
897
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
898
+ }
899
+ ]
900
+ }
901
+ ]
902
+ },
903
+ {
904
+ "id": "privacy_concerns",
905
+ "children": [
906
+ {
907
+ "id": "unnecessary_data_collection",
908
+ "children": [
909
+ {
910
+ "id": "wifi_ssid_password",
911
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
912
+ }
913
+ ]
914
+ }
915
+ ]
916
+ },
917
+ {
918
+ "id": "protocol_specific_misconfiguration",
919
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
920
+ },
921
+ {
922
+ "id": "sensitive_data_exposure",
923
+ "children": [
924
+ {
925
+ "id": "disclosure_of_known_public_information",
926
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
927
+ },
928
+ {
929
+ "id": "disclosure_of_secrets",
930
+ "children": [
931
+ {
932
+ "id": "data_traffic_spam",
933
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
934
+ },
935
+ {
936
+ "id": "for_internal_asset",
937
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
938
+ },
939
+ {
940
+ "id": "for_publicly_accessible_asset",
941
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
942
+ },
943
+ {
944
+ "id": "intentionally_public_sample_or_invalid",
945
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
946
+ },
947
+ {
948
+ "id": "non_corporate_user",
949
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
950
+ },
951
+ {
952
+ "id": "pay_per_use_abuse",
953
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
954
+ },
955
+ {
956
+ "id": "pii_leakage_exposure",
957
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
958
+ }
959
+ ]
960
+ },
961
+ {
962
+ "id": "exif_geolocation_data_not_stripped_from_uploaded_images",
963
+ "children": [
964
+ {
965
+ "id": "automatic_user_enumeration",
966
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
967
+ },
968
+ {
969
+ "id": "manual_user_enumeration",
970
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
971
+ }
972
+ ]
973
+ },
974
+ {
975
+ "id": "internal_ip_disclosure",
976
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
977
+ },
978
+ {
979
+ "id": "json_hijacking",
980
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
981
+ },
982
+ {
983
+ "id": "mixed_content",
984
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
985
+ },
986
+ {
987
+ "id": "non_sensitive_token_in_url",
988
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
989
+ },
990
+ {
991
+ "id": "sensitive_data_hardcoded",
992
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
993
+ },
994
+ {
995
+ "id": "sensitive_token_in_url",
996
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
997
+ },
998
+ {
999
+ "id": "token_leakage_via_referer",
1000
+ "children": [
1001
+ {
1002
+ "id": "over_http",
1003
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
1004
+ },
1005
+ {
1006
+ "id": "password_reset_token",
1007
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1008
+ },
1009
+ {
1010
+ "id": "trusted_third_party",
1011
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
1012
+ },
1013
+ {
1014
+ "id": "untrusted_third_party",
1015
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
1016
+ }
1017
+ ]
1018
+ },
1019
+ {
1020
+ "id": "via_localstorage_sessionstorage",
1021
+ "children": [
1022
+ {
1023
+ "id": "non_sensitive_token",
1024
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1025
+ },
1026
+ {
1027
+ "id": "sensitive_token",
1028
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1029
+ }
1030
+ ]
1031
+ },
1032
+ {
1033
+ "id": "visible_detailed_error_page",
1034
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1035
+ "children": [
1036
+ {
1037
+ "id": "detailed_server_configuration",
1038
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1039
+ }
1040
+ ]
1041
+ },
1042
+ {
1043
+ "id": "weak_password_reset_implementation",
1044
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
1045
+ "children": [
1046
+ {
1047
+ "id": "token_leakage_via_host_header_poisoning",
1048
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
1049
+ }
1050
+ ]
1051
+ },
1052
+ {
1053
+ "id": "xssi",
1054
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
1055
+ }
1056
+ ]
1057
+ },
1058
+ {
1059
+ "id": "server_security_misconfiguration",
1060
+ "children": [
1061
+ {
1062
+ "id": "bitsquatting",
1063
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1064
+ },
1065
+ {
1066
+ "id": "cache_poisoning",
1067
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1068
+ },
1069
+ {
1070
+ "id": "captcha",
1071
+ "children": [
1072
+ {
1073
+ "id": "brute_force",
1074
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1075
+ },
1076
+ {
1077
+ "id": "implementation_vulnerability",
1078
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1079
+ },
1080
+ {
1081
+ "id": "missing",
1082
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1083
+ }
1084
+ ]
1085
+ },
1086
+ {
1087
+ "id": "clickjacking",
1088
+ "children": [
1089
+ {
1090
+ "id": "form_input",
1091
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1092
+ },
1093
+ {
1094
+ "id": "non_sensitive_action",
1095
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
1096
+ },
1097
+ {
1098
+ "id": "sensitive_action",
1099
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1100
+ }
1101
+ ]
1102
+ },
1103
+ {
1104
+ "id": "cookie_scoped_to_parent_domain",
1105
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1106
+ },
1107
+ {
1108
+ "id": "dbms_misconfiguration",
1109
+ "children": [
1110
+ {
1111
+ "id": "excessively_privileged_user_dba",
1112
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
1113
+ }
1114
+ ]
1115
+ },
1116
+ {
1117
+ "id": "directory_listing_enabled",
1118
+ "children": [
1119
+ {
1120
+ "id": "non_sensitive_data_exposure",
1121
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1122
+ },
1123
+ {
1124
+ "id": "sensitive_data_exposure",
1125
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
1126
+ }
1127
+ ]
1128
+ },
1129
+ {
1130
+ "id": "email_verification_bypass",
1131
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1132
+ },
1133
+ {
1134
+ "id": "exposed_admin_portal",
1135
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1136
+ },
1137
+ {
1138
+ "id": "fingerprinting_banner_disclosure",
1139
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1140
+ },
1141
+ {
1142
+ "id": "insecure_ssl",
1143
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1144
+ },
1145
+ {
1146
+ "id": "lack_of_password_confirmation",
1147
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
1148
+ "children": [
1149
+ {
1150
+ "id": "manage_two_fa",
1151
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
1152
+ }
1153
+ ]
1154
+ },
1155
+ {
1156
+ "id": "lack_of_security_headers",
1157
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
1158
+ "children": [
1159
+ {
1160
+ "id": "cache_control_for_a_sensitive_page",
1161
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1162
+ }
1163
+ ]
1164
+ },
1165
+ {
1166
+ "id": "mail_server_misconfiguration",
1167
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1168
+ "children": [
1169
+ {
1170
+ "id": "email_spoofing_to_inbox_due_to_missing_or_misconfigured_dmarc_on_email_domain",
1171
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1172
+ },
1173
+ {
1174
+ "id": "no_spoofing_protection_on_email_domain",
1175
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
1176
+ }
1177
+ ]
1178
+ },
1179
+ {
1180
+ "id": "misconfigured_dns",
1181
+ "children": [
1182
+ {
1183
+ "id": "missing_caa_record",
1184
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1185
+ },
1186
+ {
1187
+ "id": "subdomain_takeover",
1188
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1189
+ },
1190
+ {
1191
+ "id": "zone_transfer",
1192
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1193
+ }
1194
+ ]
1195
+ },
1196
+ {
1197
+ "id": "missing_dnssec",
1198
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1199
+ },
1200
+ {
1201
+ "id": "missing_secure_or_httponly_cookie_flag",
1202
+ "children": [
1203
+ {
1204
+ "id": "non_session_cookie",
1205
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1206
+ },
1207
+ {
1208
+ "id": "session_token",
1209
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1210
+ }
1211
+ ]
1212
+ },
1213
+ {
1214
+ "id": "missing_subresource_integrity",
1215
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1216
+ },
1217
+ {
1218
+ "id": "no_rate_limiting_on_form",
1219
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
1220
+ "children": [
1221
+ {
1222
+ "id": "change_password",
1223
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
1224
+ },
1225
+ {
1226
+ "id": "login",
1227
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1228
+ }
1229
+ ]
1230
+ },
1231
+ {
1232
+ "id": "oauth_misconfiguration",
1233
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
1234
+ "children": [
1235
+ {
1236
+ "id": "account_squatting",
1237
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
1238
+ },
1239
+ {
1240
+ "id": "account_takeover",
1241
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
1242
+ }
1243
+ ]
1244
+ },
1245
+ {
1246
+ "id": "path_traversal",
1247
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
1248
+ },
1249
+ {
1250
+ "id": "potentially_unsafe_http_method_enabled",
1251
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1252
+ },
1253
+ {
1254
+ "id": "race_condition",
1255
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1256
+ },
1257
+ {
1258
+ "id": "request_smuggling",
1259
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1260
+ },
1261
+ {
1262
+ "id": "rfd",
1263
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
1264
+ },
1265
+ {
1266
+ "id": "same_site_scripting",
1267
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
1268
+ },
1269
+ {
1270
+ "id": "server_side_request_forgery_ssrf",
1271
+ "children": [
1272
+ {
1273
+ "id": "external_dns_query_only",
1274
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
1275
+ },
1276
+ {
1277
+ "id": "external_low_impact",
1278
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
1279
+ },
1280
+ {
1281
+ "id": "internal_high_impact",
1282
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
1283
+ },
1284
+ {
1285
+ "id": "internal_scan_and_or_medium_impact",
1286
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
1287
+ }
1288
+ ]
1289
+ },
1290
+ {
1291
+ "id": "software_package_takeover",
1292
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
1293
+ },
1294
+ {
1295
+ "id": "ssl_attack_breach_poodle_etc",
1296
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
1297
+ },
1298
+ {
1299
+ "id": "unsafe_cross_origin_resource_sharing",
1300
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
1301
+ },
1302
+ {
1303
+ "id": "unsafe_file_upload",
1304
+ "children": [
1305
+ {
1306
+ "id": "file_extension_filter_bypass",
1307
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1308
+ },
1309
+ {
1310
+ "id": "no_antivirus",
1311
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
1312
+ },
1313
+ {
1314
+ "id": "no_size_limit",
1315
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1316
+ }
1317
+ ]
1318
+ },
1319
+ {
1320
+ "id": "username_enumeration",
1321
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1322
+ },
1323
+ {
1324
+ "id": "using_default_credentials",
1325
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
1326
+ },
1327
+ {
1328
+ "id": "waf_bypass",
1329
+ "children": [
1330
+ {
1331
+ "id": "direct_server_access",
1332
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1333
+ }
1334
+ ]
1335
+ }
1336
+ ]
1337
+ },
1338
+ {
1339
+ "id": "server_side_injection",
1340
+ "children": [
1341
+ {
1342
+ "id": "content_spoofing",
1343
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
1344
+ "children": [
1345
+ {
1346
+ "id": "email_html_injection",
1347
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1348
+ },
1349
+ {
1350
+ "id": "external_authentication_injection",
1351
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1352
+ },
1353
+ {
1354
+ "id": "flash_based_external_authentication_injection",
1355
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1356
+ },
1357
+ {
1358
+ "id": "html_content_injection",
1359
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1360
+ },
1361
+ {
1362
+ "id": "iframe_injection",
1363
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
1364
+ },
1365
+ {
1366
+ "id": "impersonation_via_broken_link_hijacking",
1367
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1368
+ }
1369
+ ]
1370
+ },
1371
+ {
1372
+ "id": "file_inclusion",
1373
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
1374
+ },
1375
+ {
1376
+ "id": "http_response_manipulation",
1377
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
1378
+ },
1379
+ {
1380
+ "id": "ldap_injection",
1381
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1382
+ },
1383
+ {
1384
+ "id": "parameter_pollution",
1385
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1386
+ },
1387
+ {
1388
+ "id": "remote_code_execution_rce",
1389
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1390
+ },
1391
+ {
1392
+ "id": "sql_injection",
1393
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
1394
+ },
1395
+ {
1396
+ "id": "ssti",
1397
+ "children": [
1398
+ {
1399
+ "id": "basic",
1400
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1401
+ },
1402
+ {
1403
+ "id": "custom",
1404
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
1405
+ }
1406
+ ]
1407
+ },
1408
+ {
1409
+ "id": "xml_external_entity_injection_xxe",
1410
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
1411
+ }
1412
+ ]
1413
+ },
1414
+ {
1415
+ "id": "smart_contract_misconfiguration",
1416
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1417
+ },
1418
+ {
1419
+ "id": "societal_biases",
1420
+ "children": [
1421
+ {
1422
+ "id": "confirmation_bias",
1423
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
1424
+ },
1425
+ {
1426
+ "id": "systemic_bias",
1427
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
1428
+ }
1429
+ ]
1430
+ },
1431
+ {
1432
+ "id": "unvalidated_redirects_and_forwards",
1433
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1434
+ "children": [
1435
+ {
1436
+ "id": "open_redirect",
1437
+ "children": [
1438
+ {
1439
+ "id": "get_based",
1440
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1441
+ }
1442
+ ]
1443
+ }
1444
+ ]
1445
+ },
1446
+ {
1447
+ "id": "using_components_with_known_vulnerabilities",
1448
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1449
+ "children": [
1450
+ {
1451
+ "id": "rosetta_flash",
1452
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1453
+ }
1454
+ ]
1455
+ },
1456
+ {
1457
+ "id": "zero_knowledge_security_misconfiguration",
1458
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1459
+ }
1460
+ ]
1461
+ }