vrt 0.5.1 → 0.6.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (13) hide show
  1. checksums.yaml +4 -4
  2. data/lib/data/1.5/deprecated-node-mapping.json +113 -0
  3. data/lib/data/1.5/mappings/cvss_v3.json +817 -0
  4. data/lib/data/1.5/mappings/cvss_v3.schema.json +59 -0
  5. data/lib/data/1.5/mappings/cwe.json +423 -0
  6. data/lib/data/1.5/mappings/cwe.schema.json +63 -0
  7. data/lib/data/1.5/mappings/remediation_advice.json +1197 -0
  8. data/lib/data/1.5/mappings/remediation_advice.schema.json +75 -0
  9. data/lib/data/1.5/vrt.schema.json +63 -0
  10. data/lib/data/1.5/vulnerability-rating-taxonomy.json +1783 -0
  11. data/lib/vrt/mapping.rb +1 -1
  12. data/lib/vrt/version.rb +1 -1
  13. metadata +15 -6
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 642f88ca4984745ddceb7817ee6e71939f52c216
4
- data.tar.gz: 1d58a3e55b2153dd8e1b71fec4007fc1204c0fb5
3
+ metadata.gz: 0bbf3f9665646c0a5684190da5d391a67876c9e8
4
+ data.tar.gz: cd55a28fa619b35f0408225183a176ab1ff89738
5
5
  SHA512:
6
- metadata.gz: 3208e0f62cd08885342f8d48381522d0bc75d7379bfabbc90ba165a8d89864008bb36b46a120520dafae78353fccc561bf63bde2fe87339eceb20a5a95c9b5d6
7
- data.tar.gz: 4af600357cd9d8f717e3fcf9e08fc57e735539ce06e58faae63fcd30de9bc09252b8f55ca44d4bdb9b1212b3b3abc5bda68248b3b5f27a40b78fc5c79eaef4ed
6
+ metadata.gz: 52d1c1178403a7970f12882511a4a989b4f7230ecd3946537371ef46a2f78075839a171f93c5e3709f60f80128275006f5c26b7690620661c16bba53b8de3651
7
+ data.tar.gz: a9f9f9fe94abba85cef0d214246f4c78b475c7f8c31f427a6be8556d2d83b39fdb04c291af11056c2bc409787c20d0fdce29e8580d3f49291d1d6fe09483f7c3
data/lib/data/1.5/deprecated-node-mapping.json ADDED
@@ -0,0 +1,113 @@
1
+ {
2
+ "poor_physical_security": {
3
+ "1.1": "other"
4
+ },
5
+ "social_engineering": {
6
+ "1.1": "other"
7
+ },
8
+ "unvalidated_redirects_and_forwards.open_redirect.get_based_all_users": {
9
+ "1.2": "unvalidated_redirects_and_forwards.open_redirect.get_based"
10
+ },
11
+ "unvalidated_redirects_and_forwards.open_redirect.get_based_authenticated": {
12
+ "1.2": "unvalidated_redirects_and_forwards.open_redirect.get_based"
13
+ },
14
+ "unvalidated_redirects_and_forwards.open_redirect.get_based_unauthenticated": {
15
+ "1.2": "unvalidated_redirects_and_forwards.open_redirect.get_based"
16
+ },
17
+ "broken_authentication_and_session_management.session_token_in_url.over_https": {
18
+ "1.2": "sensitive_data_exposure.sensitive_token_in_url"
19
+ },
20
+ "broken_authentication_and_session_management.session_token_in_url.over_http": {
21
+ "1.2": "sensitive_data_exposure.sensitive_token_in_url"
22
+ },
23
+ "broken_authentication_and_session_management.session_token_in_url": {
24
+ "1.2": "sensitive_data_exposure.sensitive_token_in_url"
25
+ },
26
+ "insecure_data_transport": {
27
+ "1.2": "mobile_security_misconfiguration"
28
+ },
29
+ "insecure_data_transport.ssl_certificate_pinning": {
30
+ "1.2": "mobile_security_misconfiguration.ssl_certificate_pinning"
31
+ },
32
+ "insecure_data_transport.ssl_certificate_pinning.absent": {
33
+ "1.2": "mobile_security_misconfiguration.ssl_certificate_pinning.absent"
34
+ },
35
+ "insecure_data_transport.ssl_certificate_pinning.defeatable": {
36
+ "1.2": "mobile_security_misconfiguration.ssl_certificate_pinning.defeatable"
37
+ },
38
+ "insecure_data_storage.credentials_stored_unencrypted": {
39
+ "1.2": "insecure_data_storage.sensitive_application_data_stored_unencrypted"
40
+ },
41
+ "insecure_data_storage.credentials_stored_unencrypted.on_external_storage": {
42
+ "1.2": "insecure_data_storage.sensitive_application_data_stored_unencrypted.on_external_storage"
43
+ },
44
+ "insecure_data_storage.credentials_stored_unencrypted.on_internal_storage": {
45
+ "1.2": "insecure_data_storage.sensitive_application_data_stored_unencrypted.on_internal_storage"
46
+ },
47
+ "insufficient_security_configurability.weak_password_policy.complexity_both_length_and_char_type_not_enforced": {
48
+ "1.2": "insufficient_security_configurability.no_password_policy"
49
+ },
50
+ "missing_function_level_access_control": {
51
+ "1.3": "broken_access_control"
52
+ },
53
+ "missing_function_level_access_control.server_side_request_forgery_ssrf": {
54
+ "1.3": "broken_access_control.server_side_request_forgery_ssrf"
55
+ },
56
+ "missing_function_level_access_control.server_side_request_forgery_ssrf.internal": {
57
+ "1.3": "broken_access_control.server_side_request_forgery_ssrf.internal"
58
+ },
59
+ "missing_function_level_access_control.server_side_request_forgery_ssrf.external": {
60
+ "1.3": "broken_access_control.server_side_request_forgery_ssrf.external"
61
+ },
62
+ "missing_function_level_access_control.username_enumeration": {
63
+ "1.3": "broken_access_control.username_enumeration"
64
+ },
65
+ "missing_function_level_access_control.username_enumeration.data_leak": {
66
+ "1.3": "broken_access_control.username_enumeration.data_leak"
67
+ },
68
+ "missing_function_level_access_control.exposed_sensitive_android_intent": {
69
+ "1.3": "broken_access_control.exposed_sensitive_android_intent"
70
+ },
71
+ "missing_function_level_access_control.exposed_sensitive_ios_url_scheme": {
72
+ "1.3": "broken_access_control.exposed_sensitive_ios_url_scheme"
73
+ },
74
+ "insecure_direct_object_references_idor": {
75
+ "1.3": "broken_access_control.idor"
76
+ },
77
+ "broken_authentication_and_session_management.weak_login_function.over_http": {
78
+ "1.4": "broken_authentication_and_session_management.weak_login_function.https_not_available_or_http_by_default"
79
+ },
80
+ "cross_site_scripting_xss.ie_only.older_version_ie_10_11": {
81
+ "1.4": "cross_site_scripting_xss.ie_only.ie11"
82
+ },
83
+ "cross_site_scripting_xss.ie_only.older_version_ie10": {
84
+ "1.4": "cross_site_scripting_xss.ie_only.older_version_ie11"
85
+ },
86
+ "broken_authentication_and_session_management.failure_to_invalidate_session.on_password_reset": {
87
+ "1.4": "broken_authentication_and_session_management.failure_to_invalidate_session.on_password_change"
88
+ },
89
+ "network_security_misconfiguration.telnet_enabled.credentials_required": {
90
+ "1.4": "broken_authentication_and_session_management.weak_login_function.other_plaintext_protocol_no_secure_alternative"
91
+ },
92
+ "server_security_misconfiguration.mail_server_misconfiguration.missing_spf_on_email_domain": {
93
+ "1.5": "server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_on_email_domain"
94
+ },
95
+ "server_security_misconfiguration.mail_server_misconfiguration.email_spoofable_via_third_party_api_misconfiguration": {
96
+ "1.5": "server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_on_email_domain"
97
+ },
98
+ "cross_site_scripting_xss.stored.admin_to_anyone": {
99
+ "1.5": "cross_site_scripting_xss.stored.privileged_user_to_privilege_elevation"
100
+ },
101
+ "server_security_misconfiguration.misconfigured_dns.subdomain_takeover": {
102
+ "1.5": "server_security_misconfiguration.misconfigured_dns.basic_subdomain_takeover"
103
+ },
104
+ "server_security_misconfiguration.captcha_bypass": {
105
+ "1.5": "server_security_misconfiguration.captcha"
106
+ },
107
+ "server_security_misconfiguration.captcha_bypass.implementation_vulnerability": {
108
+ "1.5": "server_security_misconfiguration.captcha.implementation_vulnerability"
109
+ },
110
+ "server_security_misconfiguration.captcha_bypass.brute_force": {
111
+ "1.5": "server_security_misconfiguration.captcha.brute_force"
112
+ }
113
+ }
data/lib/data/1.5/mappings/cvss_v3.json ADDED
@@ -0,0 +1,817 @@
1
+ {
2
+ "metadata": {
3
+ "default": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
4
+ },
5
+ "content": [
6
+ {
7
+ "id": "server_security_misconfiguration",
8
+ "children": [
9
+ {
10
+ "id": "unsafe_cross_origin_resource_sharing",
11
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
12
+ },
13
+ {
14
+ "id": "path_traversal",
15
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
16
+ },
17
+ {
18
+ "id": "directory_listing_enabled",
19
+ "children": [
20
+ {
21
+ "id": "sensitive_data_exposure",
22
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
23
+ },
24
+ {
25
+ "id": "non_sensitive_data_exposure",
26
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
27
+ }
28
+ ]
29
+ },
30
+ {
31
+ "id": "same_site_scripting",
32
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
33
+ },
34
+ {
35
+ "id": "ssl_attack_breach_poodle_etc",
36
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
37
+ },
38
+ {
39
+ "id": "using_default_credentials",
40
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
41
+ },
42
+ {
43
+ "id": "misconfigured_dns",
44
+ "children": [
45
+ {
46
+ "id": "basic_subdomain_takeover",
47
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
48
+ },
49
+ {
50
+ "id": "high_impact_subdomain_takeover",
51
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
52
+ },
53
+ {
54
+ "id": "zone_transfer",
55
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
56
+ },
57
+ {
58
+ "id": "missing_caa_record",
59
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
60
+ }
61
+ ]
62
+ },
63
+ {
64
+ "id": "mail_server_misconfiguration",
65
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
66
+ "children": [
67
+ {
68
+ "id": "email_spoofing_on_email_domain",
69
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
70
+ }
71
+ ]
72
+ },
73
+ {
74
+ "id": "dbms_misconfiguration",
75
+ "children": [
76
+ {
77
+ "id": "excessively_privileged_user_dba",
78
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
79
+ }
80
+ ]
81
+ },
82
+ {
83
+ "id": "lack_of_password_confirmation",
84
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
85
+ "children": [
86
+ {
87
+ "id": "manage_two_fa",
88
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
89
+ }
90
+ ]
91
+ },
92
+ {
93
+ "id": "no_rate_limiting_on_form",
94
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
95
+ "children": [
96
+ {
97
+ "id": "login",
98
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
99
+ }
100
+ ]
101
+ },
102
+ {
103
+ "id": "unsafe_file_upload",
104
+ "children": [
105
+ {
106
+ "id": "no_antivirus",
107
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
108
+ },
109
+ {
110
+ "id": "no_size_limit",
111
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
112
+ },
113
+ {
114
+ "id": "file_extension_filter_bypass",
115
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
116
+ }
117
+ ]
118
+ },
119
+ {
120
+ "id": "cookie_scoped_to_parent_domain",
121
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
122
+ },
123
+ {
124
+ "id": "missing_secure_or_httponly_cookie_flag",
125
+ "children": [
126
+ {
127
+ "id": "session_token",
128
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
129
+ },
130
+ {
131
+ "id": "non_session_cookie",
132
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
133
+ }
134
+ ]
135
+ },
136
+ {
137
+ "id": "clickjacking",
138
+ "children": [
139
+ {
140
+ "id": "sensitive_action",
141
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
142
+ },
143
+ {
144
+ "id": "form_input",
145
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
146
+ },
147
+ {
148
+ "id": "non_sensitive_action",
149
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
150
+ }
151
+ ]
152
+ },
153
+ {
154
+ "id": "oauth_misconfiguration",
155
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
156
+ "children": [
157
+ {
158
+ "id": "account_takeover",
159
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
160
+ }
161
+ ]
162
+ },
163
+ {
164
+ "id": "captcha",
165
+ "children": [
166
+ {
167
+ "id": "implementation_vulnerability",
168
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
169
+ },
170
+ {
171
+ "id": "brute_force",
172
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
173
+ },
174
+ {
175
+ "id": "missing",
176
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
177
+ }
178
+ ]
179
+ },
180
+ {
181
+ "id": "exposed_admin_portal",
182
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
183
+ },
184
+ {
185
+ "id": "missing_dnssec",
186
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
187
+ },
188
+ {
189
+ "id": "fingerprinting_banner_disclosure",
190
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
191
+ },
192
+ {
193
+ "id": "username_enumeration",
194
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
195
+ },
196
+ {
197
+ "id": "potentially_unsafe_http_method_enabled",
198
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
199
+ },
200
+ {
201
+ "id": "insecure_ssl",
202
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
203
+ },
204
+ {
205
+ "id": "rfd",
206
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
207
+ },
208
+ {
209
+ "id": "lack_of_security_headers",
210
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
211
+ "children": [
212
+ {
213
+ "id": "cache_control_for_a_sensitive_page",
214
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
215
+ }
216
+ ]
217
+ },
218
+ {
219
+ "id": "waf_bypass",
220
+ "children": [
221
+ {
222
+ "id": "direct_server_access",
223
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
224
+ }
225
+ ]
226
+ },
227
+ {
228
+ "id": "bitsquatting",
229
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
230
+ }
231
+ ]
232
+ },
233
+ {
234
+ "id": "server_side_injection",
235
+ "children": [
236
+ {
237
+ "id": "file_inclusion",
238
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
239
+ },
240
+ {
241
+ "id": "parameter_pollution",
242
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
243
+ },
244
+ {
245
+ "id": "remote_code_execution_rce",
246
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
247
+ },
248
+ {
249
+ "id": "sql_injection",
250
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
251
+ },
252
+ {
253
+ "id": "xml_external_entity_injection_xxe",
254
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
255
+ },
256
+ {
257
+ "id": "http_response_manipulation",
258
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
259
+ },
260
+ {
261
+ "id": "content_spoofing",
262
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
263
+ "children": [
264
+ {
265
+ "id": "iframe_injection",
266
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
267
+ },
268
+ {
269
+ "id": "external_authentication_injection",
270
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
271
+ },
272
+ {
273
+ "id": "flash_based_external_authentication_injection",
274
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
275
+ },
276
+ {
277
+ "id": "email_html_injection",
278
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
279
+ }
280
+ ]
281
+ }
282
+ ]
283
+ },
284
+ {
285
+ "id": "broken_authentication_and_session_management",
286
+ "children": [
287
+ {
288
+ "id": "authentication_bypass",
289
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
290
+ },
291
+ {
292
+ "id": "two_fa_bypass",
293
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
294
+ },
295
+ {
296
+ "id": "privilege_escalation",
297
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
298
+ },
299
+ {
300
+ "id": "cleartext_transmission_of_session_token",
301
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
302
+ },
303
+ {
304
+ "id": "weak_login_function",
305
+ "children": [
306
+ {
307
+ "id": "not_operational",
308
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
309
+ },
310
+ {
311
+ "id": "other_plaintext_protocol_no_secure_alternative",
312
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
313
+ },
314
+ {
315
+ "id": "lan_only",
316
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
317
+ },
318
+ {
319
+ "id": "http_and_https_available",
320
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
321
+ },
322
+ {
323
+ "id": "https_not_available_or_http_by_default",
324
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
325
+ }
326
+ ]
327
+ },
328
+ {
329
+ "id": "session_fixation",
330
+ "children": [
331
+ {
332
+ "id": "remote_attack_vector",
333
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
334
+ },
335
+ {
336
+ "id": "local_attack_vector",
337
+ "cvss_v3": "AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
338
+ }
339
+ ]
340
+ },
341
+ {
342
+ "id": "failure_to_invalidate_session",
343
+ "children": [
344
+ {
345
+ "id": "on_logout",
346
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
347
+ },
348
+ {
349
+ "id": "on_logout_server_side_only",
350
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
351
+ },
352
+ {
353
+ "id": "on_password_change",
354
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
355
+ },
356
+ {
357
+ "id": "all_sessions",
358
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
359
+ },
360
+ {
361
+ "id": "on_email_change",
362
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
363
+ },
364
+ {
365
+ "id": "long_timeout",
366
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
367
+ }
368
+ ]
369
+ },
370
+ {
371
+ "id": "concurrent_logins",
372
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
373
+ },
374
+ {
375
+ "id": "weak_registration_implementation",
376
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
377
+ }
378
+ ]
379
+ },
380
+ {
381
+ "id": "sensitive_data_exposure",
382
+ "children": [
383
+ {
384
+ "id": "critically_sensitive_data",
385
+ "children": [
386
+ {
387
+ "id": "password_disclosure",
388
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
389
+ },
390
+ {
391
+ "id": "private_api_keys",
392
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
393
+ }
394
+ ]
395
+ },
396
+ {
397
+ "id": "exif_geolocation_data_not_stripped_from_uploaded_images",
398
+ "children": [
399
+ {
400
+ "id": "automatic_user_enumeration",
401
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
402
+ },
403
+ {
404
+ "id": "manual_user_enumeration",
405
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
406
+ }
407
+ ]
408
+ },
409
+ {
410
+ "id": "visible_detailed_error_page",
411
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
412
+ "children": [
413
+ {
414
+ "id": "detailed_server_configuration",
415
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
416
+ }
417
+ ]
418
+ },
419
+ {
420
+ "id": "disclosure_of_known_public_information",
421
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
422
+ },
423
+ {
424
+ "id": "token_leakage_via_referer",
425
+ "children": [
426
+ {
427
+ "id": "trusted_3rd_party",
428
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
429
+ },
430
+ {
431
+ "id": "untrusted_3rd_party",
432
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
433
+ },
434
+ {
435
+ "id": "over_http",
436
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
437
+ }
438
+ ]
439
+ },
440
+ {
441
+ "id": "sensitive_token_in_url",
442
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
443
+ },
444
+ {
445
+ "id": "non_sensitive_token_in_url",
446
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
447
+ },
448
+ {
449
+ "id": "weak_password_reset_implementation",
450
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
451
+ },
452
+ {
453
+ "id": "mixed_content",
454
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
455
+ },
456
+ {
457
+ "id": "sensitive_data_hardcoded",
458
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
459
+ },
460
+ {
461
+ "id": "internal_ip_disclosure",
462
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
463
+ },
464
+ {
465
+ "id": "xssi",
466
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
467
+ },
468
+ {
469
+ "id": "json_hijacking",
470
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
471
+ }
472
+ ]
473
+ },
474
+ {
475
+ "id": "cross_site_scripting_xss",
476
+ "children": [
477
+ {
478
+ "id": "stored",
479
+ "children": [
480
+ {
481
+ "id": "non_admin_to_anyone",
482
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
483
+ },
484
+ {
485
+ "id": "privileged_user_to_privilege_elevation",
486
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
487
+ },
488
+ {
489
+ "id": "privileged_user_to_no_privilege_elevation",
490
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
491
+ },
492
+ {
493
+ "id": "url_based",
494
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
495
+ },
496
+ {
497
+ "id": "self",
498
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
499
+ }
500
+ ]
501
+ },
502
+ {
503
+ "id": "reflected",
504
+ "children": [
505
+ {
506
+ "id": "non_self",
507
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
508
+ },
509
+ {
510
+ "id": "self",
511
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
512
+ }
513
+ ]
514
+ },
515
+ {
516
+ "id": "flash_based",
517
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
518
+ },
519
+ {
520
+ "id": "cookie_based",
521
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
522
+ },
523
+ {
524
+ "id": "ie_only",
525
+ "children": [
526
+ {
527
+ "id": "ie11",
528
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
529
+ },
530
+ {
531
+ "id": "xss_filter_disabled",
532
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
533
+ },
534
+ {
535
+ "id": "older_version_ie11",
536
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N"
537
+ }
538
+ ]
539
+ },
540
+ {
541
+ "id": "referer",
542
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
543
+ },
544
+ {
545
+ "id": "trace_method",
546
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
547
+ },
548
+ {
549
+ "id": "universal_uxss",
550
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
551
+ },
552
+ {
553
+ "id": "off_domain",
554
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
555
+ }
556
+ ]
557
+ },
558
+ {
559
+ "id": "broken_access_control",
560
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
561
+ "children": [
562
+ {
563
+ "id": "server_side_request_forgery_ssrf",
564
+ "children": [
565
+ {
566
+ "id": "internal",
567
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
568
+ },
569
+ {
570
+ "id": "external",
571
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
572
+ }
573
+ ]
574
+ },
575
+ {
576
+ "id": "username_enumeration",
577
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
578
+ }
579
+ ]
580
+ },
581
+ {
582
+ "id": "cross_site_request_forgery_csrf",
583
+ "children": [
584
+ {
585
+ "id": "application_wide",
586
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
587
+ },
588
+ {
589
+ "id": "action_specific",
590
+ "children": [
591
+ {
592
+ "id": "authenticated_action",
593
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
594
+ },
595
+ {
596
+ "id": "unauthenticated_action",
597
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
598
+ },
599
+ {
600
+ "id": "logout",
601
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
602
+ }
603
+ ]
604
+ },
605
+ {
606
+ "id": "csrf_token_not_unique_per_request",
607
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
608
+ }
609
+ ]
610
+ },
611
+ {
612
+ "id": "application_level_denial_of_service_dos",
613
+ "children": [
614
+ {
615
+ "id": "critical_impact_and_or_easy_difficulty",
616
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
617
+ },
618
+ {
619
+ "id": "high_impact_and_or_medium_difficulty",
620
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
621
+ },
622
+ {
623
+ "id": "app_crash",
624
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
625
+ }
626
+ ]
627
+ },
628
+ {
629
+ "id": "unvalidated_redirects_and_forwards",
630
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
631
+ "children": [
632
+ {
633
+ "id": "open_redirect",
634
+ "children": [
635
+ {
636
+ "id": "get_based",
637
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
638
+ }
639
+ ]
640
+ }
641
+ ]
642
+ },
643
+ {
644
+ "id": "external_behavior",
645
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
646
+ },
647
+ {
648
+ "id": "insufficient_security_configurability",
649
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
650
+ "children": [
651
+ {
652
+ "id": "no_password_policy",
653
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
654
+ },
655
+ {
656
+ "id": "weak_password_reset_implementation",
657
+ "children": [
658
+ {
659
+ "id": "token_is_not_invalidated_after_use",
660
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
661
+ }
662
+ ]
663
+ }
664
+ ]
665
+ },
666
+ {
667
+ "id": "using_components_with_known_vulnerabilities",
668
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
669
+ "children": [
670
+ {
671
+ "id": "rosetta_flash",
672
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
673
+ }
674
+ ]
675
+ },
676
+ {
677
+ "id": "insecure_data_storage",
678
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
679
+ "children": [
680
+ {
681
+ "id": "sensitive_application_data_stored_unencrypted",
682
+ "children": [
683
+ {
684
+ "id": "on_external_storage",
685
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
686
+ }
687
+ ]
688
+ },
689
+ {
690
+ "id": "server_side_credentials_storage",
691
+ "children": [
692
+ {
693
+ "id": "plaintext",
694
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
695
+ }
696
+ ]
697
+ }
698
+ ]
699
+ },
700
+ {
701
+ "id": "lack_of_binary_hardening",
702
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
703
+ },
704
+ {
705
+ "id": "insecure_data_transport",
706
+ "children": [
707
+ {
708
+ "id": "cleartext_transmission_of_sensitive_data",
709
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
710
+ },
711
+ {
712
+ "id": "executable_download",
713
+ "children": [
714
+ {
715
+ "id": "no_secure_integrity_check",
716
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
717
+ },
718
+ {
719
+ "id": "secure_integrity_check",
720
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
721
+ }
722
+ ]
723
+ }
724
+ ]
725
+ },
726
+ {
727
+ "id": "insecure_os_firmware",
728
+ "children": [
729
+ {
730
+ "id": "command_injection",
731
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
732
+ },
733
+ {
734
+ "id": "hardcoded_password",
735
+ "children": [
736
+ {
737
+ "id": "privileged_user",
738
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
739
+ },
740
+ {
741
+ "id": "non_privileged_user",
742
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
743
+ }
744
+ ]
745
+ }
746
+ ]
747
+ },
748
+ {
749
+ "id": "broken_cryptography",
750
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
751
+ },
752
+ {
753
+ "id": "privacy_concerns",
754
+ "children": [
755
+ {
756
+ "id": "unnecessary_data_collection",
757
+ "children": [
758
+ {
759
+ "id": "wifi_ssid_password",
760
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
761
+ }
762
+ ]
763
+ }
764
+ ]
765
+ },
766
+ {
767
+ "id": "network_security_misconfiguration",
768
+ "children": [
769
+ {
770
+ "id": "telnet_enabled",
771
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
772
+ }
773
+ ]
774
+ },
775
+ {
776
+ "id": "mobile_security_misconfiguration",
777
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
778
+ "children": [
779
+ {
780
+ "id": "clipboard_enabled",
781
+ "children": [
782
+ {
783
+ "id": "on_sensitive_content",
784
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
785
+ },
786
+ {
787
+ "id": "on_non_sensitive_content",
788
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
789
+ }
790
+ ]
791
+ }
792
+ ]
793
+ },
794
+ {
795
+ "id": "client_side_injection",
796
+ "children": [
797
+ {
798
+ "id": "binary_planting",
799
+ "children": [
800
+ {
801
+ "id": "privilege_escalation",
802
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
803
+ },
804
+ {
805
+ "id": "non_default_folder_privilege_escalation",
806
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
807
+ },
808
+ {
809
+ "id": "no_privilege_escalation",
810
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
811
+ }
812
+ ]
813
+ }
814
+ ]
815
+ }
816
+ ]
817
+ }