assess.sarif

{
  "$schema" : "https://json.schemastore.org/sarif-2.1.0.json",
  "version" : "2.1.0",
  "runs" : [ {
    "tool" : {
      "driver" : {
        "name" : "Contrast Assess",
        "organization" : "Contrast Security, Inc.",
        "informationUri" : "https://www.contrastsecurity.com",
        "rules" : [ {
          "id" : "cookie-header-missing-flags",
          "shortDescription" : "Cookie Has No 'secure' Flag",
          "fullDescription" : "Cookie Has No 'secure' Flag",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/614.html",
            "likelihood" : "High",
            "references" : "https://owasp.org/www-community/controls/SecureCookieAttribute",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cookie Has No 'secure' Flag{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Cookie Has No 'secure' Flag Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cookie Has No 'secure' Flag Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie in HTTPS\nSession Without 'Secure' Attribute{{/focus}}{{{nl}}}                 The\nSecure attribute for sensitive cookies in HTTPS sessions is not set,\nwhich could cause the user agent to send those cookies in plaintext over\nan HTTP session.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cookie Has No 'secure' Flag{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Cookie Has No 'secure' Flag Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cookie Has No 'secure' Flag Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie in HTTPS\nSession Without 'Secure' Attribute{{/focus}}{{{nl}}}                 The\nSecure attribute for sensitive cookies in HTTPS sessions is not set,\nwhich could cause the user agent to send those cookies in plaintext over\nan HTTP session.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Secure Communications"
          }
        }, {
          "id" : "redos",
          "shortDescription" : "Regular Expression DoS",
          "fullDescription" : "Regular Expression DoS",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/405.html",
            "likelihood" : "Low",
            "references" : "https://en.wikipedia.org/wiki/ReDoS",
            "owasp" : "https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS",
            "impact" : "High",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Regular Expression DoS{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/dos/regex$$LINK_DELIM$$Secure\nCode Warrior: Regular Expression DoS Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_55_DoS_Regex_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Regular Expression DoS Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Denial of Service - Regular\nExpression DoS{{/focus}}{{{nl}}}                 Denial of Service (DoS)\nattacks caused by Regular Expression which causes the system to hang or\ncause them to work very slowly when attacker sends a well-crafted\ninput(exponentially related to input size).Denial of service attacks\nsignificantly degrade the service quality experienced by legitimate\nusers. These attacks introduce large response delays, excessive losses,\nand service interruptions, resulting in direct impact on availability.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Regular Expression DoS{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/dos/regex$$LINK_DELIM$$Secure\nCode Warrior: Regular Expression DoS Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_55_DoS_Regex_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Regular Expression DoS Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Denial of Service - Regular\nExpression DoS{{/focus}}{{{nl}}}                 Denial of Service (DoS)\nattacks caused by Regular Expression which causes the system to hang or\ncause them to work very slowly when attacker sends a well-crafted\ninput(exponentially related to input size).Denial of service attacks\nsignificantly degrade the service quality experienced by legitimate\nusers. These attacks introduce large response delays, excessive losses,\nand service interruptions, resulting in direct impact on availability.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "hardcoded-key",
          "shortDescription" : "Hardcoded Cryptographic Key",
          "fullDescription" : "Hardcoded Cryptographic Key",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/321.html",
            "likelihood" : "Low",
            "references" : "https://www.securecoding.cert.org/confluence/display/java/MSC03-J.+Never+hard+code+sensitive+information\nhttps://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-storage",
            "impact" : "High",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Hardcoded Cryptographic Key{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/exposedkey$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Cryptographic Key Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_126_exposed_key.mp4$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Cryptographic Key Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Hard-coded\nCryptographic Key{{/focus}}{{{nl}}}                 The use of a\nhard-coded cryptographic key significantly increases the possibility\nthat encrypted data may be recovered.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Hardcoded Cryptographic Key{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/exposedkey$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Cryptographic Key Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_126_exposed_key.mp4$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Cryptographic Key Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Hard-coded\nCryptographic Key{{/focus}}{{{nl}}}                 The use of a\nhard-coded cryptographic key significantly increases the possibility\nthat encrypted data may be recovered.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Cryptography"
          }
        }, {
          "id" : "role-manager-protection",
          "shortDescription" : "Role Manager Protection Mode",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/306.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.security.roles.cookieprotectionvalue.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "custom references" : {
              "text" : "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Role Manager Protection Mode{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/missingauth$$LINK_DELIM$$Secure\nCode Warrior: Role Manager Protection Mode Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_128_improper_authentication.mp4$$LINK_DELIM$$Secure\nCode Warrior: Role Manager Protection Mode Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Authentication for\nCritical Function{{/focus}}{{{nl}}}                 The software does\nnot perform any authentication for functionality that requires a\nprovable user identity or consumes a significant amount of resources.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Role Manager Protection Mode{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/missingauth$$LINK_DELIM$$Secure\nCode Warrior: Role Manager Protection Mode Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_128_improper_authentication.mp4$$LINK_DELIM$$Secure\nCode Warrior: Role Manager Protection Mode Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Authentication for\nCritical Function{{/focus}}{{{nl}}}                 The software does\nnot perform any authentication for functionality that requires a\nprovable user identity or consumes a significant amount of resources.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "hsts-header-missing",
          "shortDescription" : "Response With Insecurely Configured Strict-Transport-Security Header",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/319.html",
            "likelihood" : "Low",
            "references" : "https://wiki.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response With Insecurely Configured Strict-Transport-Security\nHeader{{/focus}} vulnerabilities over on the Secure Code Warrior\nplatform by watching videos and completing training exercises and\nmissions that focus on secure coding.{{/paragraph}}  {{#unorderedList}}\n{{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nStrict-Transport-Security Header Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nStrict-Transport-Security Header Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response With Insecurely Configured Strict-Transport-Security\nHeader{{/focus}} vulnerabilities over on the Secure Code Warrior\nplatform by watching videos and completing training exercises and\nmissions that focus on secure coding.{{/paragraph}}  {{#unorderedList}}\n{{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nStrict-Transport-Security Header Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nStrict-Transport-Security Header Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Secure Communications"
          }
        }, {
          "id" : "wcf-exception-details",
          "shortDescription" : "WCF Exception Details",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/215.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/system.servicemodel.servicebehaviorattribute.includeexceptiondetailinfaults(v=vs.110).aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}WCF Exception Details{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/debuginfo$$LINK_DELIM$$Secure\nCode Warrior: WCF Exception Details Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_82_DEBUG_INFORMATION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: WCF Exception Details Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Insertion of Sensitive\nInformation Into Debugging Code{{/focus}}{{{nl}}}                 The\napplication inserts sensitive information into debugging code, which\ncould expose this information if the debugging code is not disabled in\nproduction.             {{/grayedData}}         {{/blockQuote}}  {{!--\nend SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}WCF Exception Details{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/debuginfo$$LINK_DELIM$$Secure\nCode Warrior: WCF Exception Details Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_82_DEBUG_INFORMATION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: WCF Exception Details Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Insertion of Sensitive\nInformation Into Debugging Code{{/focus}}{{{nl}}}                 The\napplication inserts sensitive information into debugging code, which\ncould expose this information if the debugging code is not disabled in\nproduction.             {{/grayedData}}         {{/blockQuote}}  {{!--\nend SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "wcf-metadata-enabled",
          "shortDescription" : "WCF Service Metadata Enabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/651.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/System.ServiceModel.Description.ServiceMetadataBehavior_properties(v=vs.110).aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}WCF Service Metadata Enabled{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/misconfig$$LINK_DELIM$$Secure\nCode Warrior: WCF Service Metadata Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_81_SECURITY_MISCONFIGURATION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: WCF Service Metadata Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure -\nSecurity Misconfiguration{{/focus}}{{{nl}}}                 Information\nexposure can occur as a result of security misconfiguration, typically\ndue to poor or no security configuration. Common examples of this\ninclude accidental deployment of test environment configuration to\nproduction systems, lack of error handling configured resulting in full\nerror details being shown to users, and poor directory configuration\nallowing files to be accessible when they should not be.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}WCF Service Metadata Enabled{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/misconfig$$LINK_DELIM$$Secure\nCode Warrior: WCF Service Metadata Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_81_SECURITY_MISCONFIGURATION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: WCF Service Metadata Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure -\nSecurity Misconfiguration{{/focus}}{{{nl}}}                 Information\nexposure can occur as a result of security misconfiguration, typically\ndue to poor or no security configuration. Common examples of this\ninclude accidental deployment of test environment configuration to\nproduction systems, lack of error handling configured resulting in full\nerror details being shown to users, and poor directory configuration\nallowing files to be accessible when they should not be.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "unvalidated-forward",
          "shortDescription" : "Arbitrary Server Side Forwards",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/441.html",
            "likelihood" : "Medium",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html\nhttps://blog.gdssecurity.com/labs/2011/9/9/net-servertransfer-vs-responseredirect-reiterating-a-securit.html",
            "owasp" : "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Arbitrary Server Side Forwards{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Arbitrary Server Side Forwards Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Arbitrary Server Side Forwards Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Unvalidated Redirects and\nForwards - Unvalidated Redirects and Forwards{{/focus}}{{{nl}}}\nThis vulnerability refers to the ability of an attacker to arbitrarily\nperform a redirection (external) or forward (internal) against the\nsystem. It arises due to insufficient validation or sanitisation of\ninputs used to perform a redirect or forward and may result in privilege\nescalation (in the case of a forward) or may be used to launch phishing\nattacks against users (in the case of redirects).\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Arbitrary Server Side Forwards{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Arbitrary Server Side Forwards Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Arbitrary Server Side Forwards Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Unvalidated Redirects and\nForwards - Unvalidated Redirects and Forwards{{/focus}}{{{nl}}}\nThis vulnerability refers to the ability of an attacker to arbitrarily\nperform a redirection (external) or forward (internal) against the\nsystem. It arises due to insufficient validation or sanitisation of\ninputs used to perform a redirect or forward and may result in privilege\nescalation (in the case of a forward) or may be used to launch phishing\nattacks against users (in the case of redirects).\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "cache-controls-missing",
          "shortDescription" : "Anti-Caching Controls Missing",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/525.html",
            "likelihood" : "Low",
            "references" : "",
            "owasp" : "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/06-Testing_for_Browser_Cache_Weaknesses",
            "impact" : "Low",
            "confidence level" : 1,
            "category" : "Caching"
          }
        }, {
          "id" : "header-injection",
          "shortDescription" : "Header Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/113.html",
            "likelihood" : "High",
            "references" : "https://owasp.org/www-community/vulnerabilities/CRLF_Injection",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "impact" : "Medium",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Header Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/http$$LINK_DELIM$$Secure\nCode Warrior: Header Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_24_CRLF_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Header Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nCRLF Sequences in HTTP Headers ('HTTP Request/Response\nSplitting'){{/focus}}{{{nl}}}                 When an HTTP request\ncontains unexpected CR and LF characters, the server may respond with an\noutput stream that is interpreted as “splitting” the stream into two\ndifferent HTTP messages instead of one. CR is carriage return, also\ngiven by %0d or \\r, and LF is line feed, also given by %0a or \\n.  In\naddition to CR and LF characters, other valid/RFC compliant special\ncharacters and unique character encodings can be utilized, such as HT\n(horizontal tab, also given by %09 or \\t) and SP (space, also given as +\nsign or %20).  These types of unvalidated and unexpected data in HTTP\nmessage headers allow an attacker to control the second\n"split" message to mount attacks such as server-side request\nforgery, cross-site scripting, and cache poisoning attacks.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Header Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/http$$LINK_DELIM$$Secure\nCode Warrior: Header Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_24_CRLF_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Header Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nCRLF Sequences in HTTP Headers ('HTTP Request/Response\nSplitting'){{/focus}}{{{nl}}}                 When an HTTP request\ncontains unexpected CR and LF characters, the server may respond with an\noutput stream that is interpreted as “splitting” the stream into two\ndifferent HTTP messages instead of one. CR is carriage return, also\ngiven by %0d or \\r, and LF is line feed, also given by %0a or \\n.  In\naddition to CR and LF characters, other valid/RFC compliant special\ncharacters and unique character encodings can be utilized, such as HT\n(horizontal tab, also given by %09 or \\t) and SP (space, also given as +\nsign or %20).  These types of unvalidated and unexpected data in HTTP\nmessage headers allow an attacker to control the second\n"split" message to mount attacks such as server-side request\nforgery, cross-site scripting, and cache poisoning attacks.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "viewstate-mac-disabled",
          "shortDescription": {
            "text": "Viewstate MAC Validation Disabled - short"
          },
          "fullDescription": {
            "text": "Viewstate MAC Validation Disabled - long"
          },
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "enabled" : "true",
            "cwe" : "https://cwe.mitre.org/data/definitions/20.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/950xf363(v=vs.100).aspx\nhttps://msdn.microsoft.com/en-us/library/system.web.ui.page.enableviewstatemac.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Viewstate MAC Validation Disabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Viewstate MAC Validation Disabled\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Viewstate MAC Validation Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Viewstate MAC Validation Disabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Viewstate MAC Validation Disabled\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Viewstate MAC Validation Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "hql-injection",
          "name" : "Hibernate Injection (name)",
          "shortDescription": {
            "text": "Hibernate Injection - short"
          },
          "fullDescription": {
            "text": "Hibernate Injection - long"
          },
          "helpUri" : "https://github.com/Contrast-Security-OSS/adr-runbooks/blob/main/_runbooks/sql-injection.md",
          "defaultConfiguration": {},
          "properties": {
            "tags": [
              "maintainability"
            ],
            "kind": "problem",
            "precision": "very-high",
            "id": "js/unused-local-variable-1",
            "problem.severity": "recommendation",
            "cwe" : "https://cwe.mitre.org/data/definitions/564.html",
            "likelihood" : "High",
            "references" : "https://owasp.org/www-community/Hibernate\nhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://owasp.org/www-community/attacks/SQL_Injection\nhttps://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/attacks/SQL_Injection{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Hibernate Injection{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/sql$$LINK_DELIM$$Secure\nCode Warrior: Hibernate Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_01_sql_injection.mp4$$LINK_DELIM$$Secure\nCode Warrior: Hibernate Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Injection Flaws - SQL\nInjection{{/focus}}{{{nl}}}                 This is probably one of the\ntwo most exploited vulnerabilities in web applications and has led to a\nnumber of high profile company breaches. It occurs when an application\nfails to sanitize or validate input before using it to dynamically\nconstruct a statement. An attacker that exploits this vulnerability will\nbe able to gain access to the underlying database and view or modify\ndata without permission.             {{/grayedData}} {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Hibernate Injection{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/sql$$LINK_DELIM$$Secure\nCode Warrior: Hibernate Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_01_sql_injection.mp4$$LINK_DELIM$$Secure\nCode Warrior: Hibernate Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Injection Flaws - SQL\nInjection{{/focus}}{{{nl}}}                 This is probably one of the\ntwo most exploited vulnerabilities in web applications and has led to a\nnumber of high profile company breaches. It occurs when an application\nfails to sanitize or validate input before using it to dynamically\nconstruct a statement. An attacker that exploits this vulnerability will\nbe able to gain access to the underlying database and view or modify\ndata without permission.             {{/grayedData}} {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "version-header-enabled",
          "shortDescription" : "Version Header Enabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/200.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.httpruntimesection.enableversionheader.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "custom references" : {
              "text" : "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure\nhttps://owasp.org/www-project-proactive-controls/v3/en/c8-protect-data-everywhere\nhttps://owasp.org/Top10/A02_2021-Cryptographic_Failures/\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure{{{nl}}}https://owasp.org/www-project-proactive-controls/v3/en/c8-protect-data-everywhere{{{nl}}}https://owasp.org/Top10/A02_2021-Cryptographic_Failures/{{{nl}}}"
            },
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Version Header Enabled{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Version Header Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_57_sensitive_data_exposure.mp4$$LINK_DELIM$$Secure\nCode Warrior: Version Header Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Exposure of Sensitive\nInformation to an Unauthorized Actor{{/focus}}{{{nl}}} The product\nexposes sensitive information to an actor that is not explicitly\nauthorized to have access to that information. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Version Header Enabled{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Version Header Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_57_sensitive_data_exposure.mp4$$LINK_DELIM$$Secure\nCode Warrior: Version Header Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Exposure of Sensitive\nInformation to an Unauthorized Actor{{/focus}}{{{nl}}} The product\nexposes sensitive information to an actor that is not explicitly\nauthorized to have access to that information. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "stored-xss",
          "shortDescription" : "Stored Cross-Site Scripting",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/79.html",
            "likelihood" : "High",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting",
            "custom references" : {
              "text" : "https://owasp.org/www-community/attacks/xss/\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/attacks/xss/{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Stored Cross-Site Scripting{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xss$$LINK_DELIM$$Secure\nCode Warrior: Stored Cross-Site Scripting Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_71_Cross+Site+Scripting_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Stored Cross-Site Scripting Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nInput During Web Page Generation ('Cross-site\nScripting'){{/focus}}{{{nl}}}                 The software does not\nneutralize or incorrectly neutralizes user-controllable input before it\nis placed in output that is used as a web page that is served to other\nusers.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Stored Cross-Site Scripting{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xss$$LINK_DELIM$$Secure\nCode Warrior: Stored Cross-Site Scripting Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_71_Cross+Site+Scripting_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Stored Cross-Site Scripting Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nInput During Web Page Generation ('Cross-site\nScripting'){{/focus}}{{{nl}}}                 The software does not\nneutralize or incorrectly neutralizes user-controllable input before it\nis placed in output that is used as a web page that is served to other\nusers.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}"
            },
            "category" : "XSS"
          }
        }, {
          "id" : "event-validation-disabled",
          "shortDescription" : "Event Validation Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/20.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/y123fsf7.aspx\nhttps://msdn.microsoft.com/en-us/library/system.web.ui.page.enableeventvalidation.aspx",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Event Validation Disabled{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Event Validation Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Event Validation Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Event Validation Disabled{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Event Validation Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Event Validation Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "untrusted-deserialization",
          "shortDescription" : "Untrusted Deserialization",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/502.html",
            "likelihood" : "Medium",
            "references" : "https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/\nhttps://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/",
            "custom references" : {
              "text" : "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\nhttps://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html{{{nl}}}https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data{{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Untrusted Deserialization{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/deserialization$$LINK_DELIM$$Secure\nCode Warrior: Untrusted Deserialization Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_62_Insecure_Deserialization_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Untrusted Deserialization Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Deserialization of Untrusted\nData{{/focus}}{{{nl}}}                 The application deserializes\nuntrusted data without sufficiently verifying that the resulting data\nwill be valid.             {{/grayedData}}         {{/blockQuote}} {{!--\nend SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Untrusted Deserialization{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/deserialization$$LINK_DELIM$$Secure\nCode Warrior: Untrusted Deserialization Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_62_Insecure_Deserialization_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Untrusted Deserialization Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Deserialization of Untrusted\nData{{/focus}}{{{nl}}}                 The application deserializes\nuntrusted data without sufficiently verifying that the resulting data\nwill be valid.             {{/grayedData}}         {{/blockQuote}} {{!--\nend SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "role-manager-ssl",
          "shortDescription" : "Role Manager SSL",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/319.html",
            "likelihood" : "Low",
            "references" : "https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Role Manager SSL{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Role Manager SSL Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Role Manager SSL Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Role Manager SSL{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Role Manager SSL Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Role Manager SSL Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "trust-boundary-violation",
          "shortDescription" : "Trust Boundary Violation",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/501.html",
            "likelihood" : "Medium",
            "references" : "https://owasp.org/Top10/A04_2021-Insecure_Design/",
            "owasp" : "https://owasp.org/Top10/A04_2021-Insecure_Design/",
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Trust Boundary Violation{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/blog/generic$$LINK_DELIM$$Secure\nCode Warrior: Trust Boundary Violation Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Business_Logic_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Trust Boundary Violation Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Business Logic - Logical\nError{{/focus}}{{{nl}}}                 Incorrect implementation of\nbusiness logic rules can be the cause of subtle but serious\nvulnerabilities. Depending on the purpose and functionality implemented\nwithin the application, it may allow privilege escalation or unintended\nbusiness processes to be performed.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Trust Boundary Violation{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/blog/generic$$LINK_DELIM$$Secure\nCode Warrior: Trust Boundary Violation Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Business_Logic_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Trust Boundary Violation Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Business Logic - Logical\nError{{/focus}}{{{nl}}}                 Incorrect implementation of\nbusiness logic rules can be the cause of subtle but serious\nvulnerabilities. Depending on the purpose and functionality implemented\nwithin the application, it may allow privilege escalation or unintended\nbusiness processes to be performed.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "path-traversal",
          "shortDescription" : "Path Traversal",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/22.html",
            "likelihood" : "Medium",
            "references" : "",
            "owasp" : "https://owasp.org/www-community/attacks/Path_Traversal",
            "custom references" : {
              "text" : "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 2,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Path Traversal{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/pathtraversal$$LINK_DELIM$$Secure\nCode Warrior: Path Traversal Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_196_path_traversal.mp4$$LINK_DELIM$$Secure\nCode Warrior: Path Traversal Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Limitation of a Pathname to a Restricted Directory\n('Path Traversal'){{/focus}}{{{nl}}} The software uses external input to\nconstruct a pathname that should be within a restricted directory, but\nit does not properly neutralize sequences such as ".." that\ncan resolve to a location that is outside of that directory.\n{{/grayedData}} {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Path Traversal{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/pathtraversal$$LINK_DELIM$$Secure\nCode Warrior: Path Traversal Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_196_path_traversal.mp4$$LINK_DELIM$$Secure\nCode Warrior: Path Traversal Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Limitation of a Pathname to a Restricted Directory\n('Path Traversal'){{/focus}}{{{nl}}} The software uses external input to\nconstruct a pathname that should be within a restricted directory, but\nit does not properly neutralize sequences such as ".." that\ncan resolve to a location that is outside of that directory.\n{{/grayedData}} {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "unsafe-code-execution",
          "shortDescription" : "Unsafe Code Execution",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/95.html",
            "likelihood" : "Medium",
            "references" : "https://owasp.org/www-community/attacks/Code_Injection",
            "owasp" : "https://owasp.org/Top10/A04_2021-Insecure_Design/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unsafe Code Execution{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/code$$LINK_DELIM$$Secure\nCode Warrior: Unsafe Code Execution Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_28_CODE_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unsafe Code Execution Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Injection Flaws - Code\nInjection{{/focus}}{{{nl}}}                 Code injection happens when\nan application insecurely accepts input that is subsequently used in a\ndynamic code evaluation call. If insufficient validation or sanitisation\nis performed on the input, specially crafted inputs may be able to alter\nthe syntax of the evaluated code and thus alter execution. In a worst\ncase scenario, an attacker could run arbitrary code in the server\ncontext and thus perform almost any action on the application server.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unsafe Code Execution{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/code$$LINK_DELIM$$Secure\nCode Warrior: Unsafe Code Execution Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_28_CODE_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unsafe Code Execution Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Injection Flaws - Code\nInjection{{/focus}}{{{nl}}}                 Code injection happens when\nan application insecurely accepts input that is subsequently used in a\ndynamic code evaluation call. If insufficient validation or sanitisation\nis performed on the input, specially crafted inputs may be able to alter\nthe syntax of the evaluated code and thus alter execution. In a worst\ncase scenario, an attacker could run arbitrary code in the server\ncontext and thus perform almost any action on the application server.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "unvalidated-redirect",
          "shortDescription" : "Unvalidated Redirect",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/601.html",
            "likelihood" : "Medium",
            "references" : "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html",
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unvalidated Redirect{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Unvalidated Redirect Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unvalidated Redirect Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}URL Redirection to Untrusted\nSite ('Open Redirect'){{/focus}}{{{nl}}}                 A web\napplication accepts a user-controlled input that specifies a link to an\nexternal site, and uses that link in a Redirect. This simplifies\nphishing attacks.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unvalidated Redirect{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Unvalidated Redirect Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unvalidated Redirect Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}URL Redirection to Untrusted\nSite ('Open Redirect'){{/focus}}{{{nl}}}                 A web\napplication accepts a user-controlled input that specifies a link to an\nexternal site, and uses that link in a Redirect. This simplifies\nphishing attacks.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "autocomplete-missing",
          "shortDescription" : "Forms Without Autocomplete Prevention",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/525.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/Top10/A04_2021-Insecure_Design/",
            "owasp" : "https://owasp.org/Top10/A04_2021-Insecure_Design/",
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Without Autocomplete Prevention{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/sidechannel/url_cache$$LINK_DELIM$$Secure\nCode Warrior: Forms Without Autocomplete Prevention\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_193_url_caching.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Without Autocomplete Prevention\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Use of Web Browser Cache Containing Sensitive\nInformation{{/focus}}{{{nl}}}                 The web application does\nnot use an appropriate caching policy that specifies the extent to which\neach web page and associated form fields should be cached.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Without Autocomplete Prevention{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/sidechannel/url_cache$$LINK_DELIM$$Secure\nCode Warrior: Forms Without Autocomplete Prevention\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_193_url_caching.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Without Autocomplete Prevention\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Use of Web Browser Cache Containing Sensitive\nInformation{{/focus}}{{{nl}}}                 The web application does\nnot use an appropriate caching policy that specifies the extent to which\neach web page and associated form fields should be cached.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Caching"
          }
        }, {
          "id" : "xxe",
          "shortDescription" : "XML External Entity Injection (XXE)",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/611.html",
            "likelihood" : "Medium",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}XML External Entity Injection (XXE){{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xxe/generic$$LINK_DELIM$$Secure\nCode Warrior: XML External Entity Injection (XXE)\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_23_XML_External_Entity_Injection_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: XML External Entity Injection (XXE) Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Restriction of XML\nExternal Entity Reference{{/focus}}{{{nl}}}                 The software\nprocesses an XML document that can contain XML entities with URIs that\nresolve to documents outside of the intended sphere of control, causing\nthe product to embed incorrect documents into its output.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}XML External Entity Injection (XXE){{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xxe/generic$$LINK_DELIM$$Secure\nCode Warrior: XML External Entity Injection (XXE)\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_23_XML_External_Entity_Injection_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: XML External Entity Injection (XXE) Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Restriction of XML\nExternal Entity Reference{{/focus}}{{{nl}}}                 The software\nprocesses an XML document that can contain XML entities with URIs that\nresolve to documents outside of the intended sphere of control, causing\nthe product to embed incorrect documents into its output.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "authorization-rules-misordered",
          "shortDescription" : "Authorization Rules Misordered",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/284.html",
            "likelihood" : "Medium",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.authorizationsection.aspx",
            "owasp" : "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
            "impact" : "Medium",
            "confidence level" : 2,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Authorization Rules Misordered{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/access$$LINK_DELIM$$Secure\nCode Warrior: Authorization Rules Misordered Training{{/linkExternal}}\n{{/listElement}}   {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Access\nControl{{/focus}}{{{nl}}}                 The software does not restrict\nor incorrectly restricts access to a resource from an unauthorized\nactor.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Authorization Rules Misordered{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/access$$LINK_DELIM$$Secure\nCode Warrior: Authorization Rules Misordered Training{{/linkExternal}}\n{{/listElement}}   {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Access\nControl{{/focus}}{{{nl}}}                 The software does not restrict\nor incorrectly restricts access to a resource from an unauthorized\nactor.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "smtp-injection",
          "shortDescription" : "SMTP Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/77.html",
            "likelihood" : "Medium",
            "references" : "https://www.owasp.org/index.php/Testing_for_IMAP/SMTP_Injection_(OTG-INPVAL-011)",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://wiki.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013)\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://wiki.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013){{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}SMTP Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/oscmd$$LINK_DELIM$$Secure\nCode Warrior: SMTP Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/OS+Command+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: SMTP Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements used in a Command\n('Command Injection'){{/focus}}{{{nl}}}                 The software\nconstructs all or part of a command using externally-influenced input\nfrom an upstream component, but it does not neutralize or incorrectly\nneutralizes special elements that could modify the intended command when\nit is sent to a downstream component.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}SMTP Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/oscmd$$LINK_DELIM$$Secure\nCode Warrior: SMTP Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/OS+Command+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: SMTP Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements used in a Command\n('Command Injection'){{/focus}}{{{nl}}}                 The software\nconstructs all or part of a command using externally-influenced input\nfrom an upstream component, but it does not neutralize or incorrectly\nneutralizes special elements that could modify the intended command when\nit is sent to a downstream component.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "ldap-injection",
          "shortDescription" : "LDAP Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/90.html",
            "likelihood" : "Medium",
            "references" : "https://wiki.owasp.org/index.php/LDAP_injection",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://ldap.com/2018/05/04/understanding-and-defending-against-ldap-injection-attacks/\nhttps://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://ldap.com/2018/05/04/understanding-and-defending-against-ldap-injection-attacks/{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}LDAP Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/ldap$$LINK_DELIM$$Secure\nCode Warrior: LDAP Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/LDAP_Injection_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: LDAP Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements used in an LDAP\nQuery ('LDAP Injection'){{/focus}}{{{nl}}}                 The software\nconstructs all or part of an LDAP query using externally-influenced\ninput from an upstream component, but it does not neutralize or\nincorrectly neutralizes special elements that could modify the intended\nLDAP query when it is sent to a downstream component.\n{{/grayedData}} {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}LDAP Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/ldap$$LINK_DELIM$$Secure\nCode Warrior: LDAP Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/LDAP_Injection_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: LDAP Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements used in an LDAP\nQuery ('LDAP Injection'){{/focus}}{{{nl}}}                 The software\nconstructs all or part of an LDAP query using externally-influenced\ninput from an upstream component, but it does not neutralize or\nincorrectly neutralizes special elements that could modify the intended\nLDAP query when it is sent to a downstream component.\n{{/grayedData}} {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "insecure-auth-protocol",
          "shortDescription" : "Insecure Authentication Protocol",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/287.html",
            "likelihood" : "Medium",
            "references" : "https://wiki.owasp.org/index.php/Insecure_Configuration_Management",
            "owasp" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "custom references" : {
              "text" : "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure Authentication Protocol{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/missingauth$$LINK_DELIM$$Secure\nCode Warrior: Insecure Authentication Protocol Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_128_improper_authentication.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure Authentication Protocol Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper\nAuthentication{{/focus}}{{{nl}}}                 When an actor claims to\nhave a given identity, the software does not prove or insufficiently\nproves that the claim is correct.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure Authentication Protocol{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/missingauth$$LINK_DELIM$$Secure\nCode Warrior: Insecure Authentication Protocol Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_128_improper_authentication.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure Authentication Protocol Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper\nAuthentication{{/focus}}{{{nl}}}                 When an actor claims to\nhave a given identity, the software does not prove or insufficiently\nproves that the claim is correct.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "secure-flag-missing",
          "shortDescription" : "Session Cookie Has No 'secure' Flag",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/614.html",
            "likelihood" : "High",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Session Cookie Has No 'secure' Flag{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'secure' Flag\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'secure' Flag Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie in HTTPS\nSession Without 'Secure' Attribute{{/focus}}{{{nl}}}                 The\nSecure attribute for sensitive cookies in HTTPS sessions is not set,\nwhich could cause the user agent to send those cookies in plaintext over\nan HTTP session.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Session Cookie Has No 'secure' Flag{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'secure' Flag\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'secure' Flag Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie in HTTPS\nSession Without 'Secure' Attribute{{/focus}}{{{nl}}}                 The\nSecure attribute for sensitive cookies in HTTPS sessions is not set,\nwhich could cause the user agent to send those cookies in plaintext over\nan HTTP session.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Session Management"
          }
        }, {
          "id" : "expression-language-injection",
          "shortDescription" : "Expression Language Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/88.html",
            "likelihood" : "Medium",
            "references" : "https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://wiki.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013)\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://wiki.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013){{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Expression Language Injection{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/oscmd$$LINK_DELIM$$Secure\nCode Warrior: Expression Language Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/OS+Command+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Expression Language Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nArgument Delimiters in a Command ('Argument\nInjection'){{/focus}}{{{nl}}}                 The software constructs a\nstring for a command to executed by a separate component in another\ncontrol sphere, but it does not properly delimit the intended arguments,\noptions, or switches within that command string. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Expression Language Injection{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/oscmd$$LINK_DELIM$$Secure\nCode Warrior: Expression Language Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/OS+Command+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Expression Language Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nArgument Delimiters in a Command ('Argument\nInjection'){{/focus}}{{{nl}}}                 The software constructs a\nstring for a command to executed by a separate component in another\ncontrol sphere, but it does not properly delimit the intended arguments,\noptions, or switches within that command string. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "forms-auth-ssl",
          "shortDescription" : "Forms Authentication SSL",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/319.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.formsauthenticationconfiguration.requiressl.aspx",
            "owasp" : "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Authentication SSL{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication SSL Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication SSL Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Authentication SSL{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication SSL Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication SSL Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Authentication"
          }
        }, {
          "id" : "max-request-length",
          "shortDescription" : "Large Max Request Length",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/400.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.httpruntimesection.maxrequestlength.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Large Max Request Length{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/dos/routing$$LINK_DELIM$$Secure\nCode Warrior: Large Max Request Length Training{{/linkExternal}}\n{{/listElement}}   {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Uncontrolled Resource\nConsumption{{/focus}}{{{nl}}}                 The software does not\nproperly control the allocation and maintenance of a limited resource,\nthereby enabling an actor to influence the amount of resources consumed,\neventually leading to the exhaustion of available resources.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Large Max Request Length{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/dos/routing$$LINK_DELIM$$Secure\nCode Warrior: Large Max Request Length Training{{/linkExternal}}\n{{/listElement}}   {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Uncontrolled Resource\nConsumption{{/focus}}{{{nl}}}                 The software does not\nproperly control the allocation and maintenance of a limited resource,\nthereby enabling an actor to influence the amount of resources consumed,\neventually leading to the exhaustion of available resources.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "unsafe-readline",
          "shortDescription" : "Use of readLine on Untrusted Streams",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/434.html",
            "likelihood" : "Low",
            "references" : "",
            "owasp" : "https://wiki.owasp.org/index.php/Application_Denial_of_Service",
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Use of readLine on Untrusted Streams{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/fileupload/unrestricted$$LINK_DELIM$$Secure\nCode Warrior: Use of readLine on Untrusted Streams\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_27_UNRESTRICTED_FILE_UPLOADS_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Use of readLine on Untrusted Streams\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Unrestricted Upload of File with Dangerous\nType{{/focus}}{{{nl}}}                 The software allows the attacker\nto upload or transfer files of dangerous types that can be automatically\nprocessed within the product's environment.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Use of readLine on Untrusted Streams{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/fileupload/unrestricted$$LINK_DELIM$$Secure\nCode Warrior: Use of readLine on Untrusted Streams\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_27_UNRESTRICTED_FILE_UPLOADS_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Use of readLine on Untrusted Streams\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Unrestricted Upload of File with Dangerous\nType{{/focus}}{{{nl}}}                 The software allows the attacker\nto upload or transfer files of dangerous types that can be automatically\nprocessed within the product's environment.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Availability"
          }
        }, {
          "id" : "crypto-weak-randomness",
          "shortDescription" : "Weak Random Number Generation",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/330.html",
            "likelihood" : "Low",
            "references" : "",
            "owasp" : "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
            "custom references" : {
              "text" : "https://owasp.org/www-community/vulnerabilities/Insecure_Randomness\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/vulnerabilities/Insecure_Randomness{{{nl}}}"
            },
            "impact" : "Low",
            "confidence level" : 2,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Weak Random Number Generation{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/insecurerandomness$$LINK_DELIM$$Secure\nCode Warrior: Weak Random Number Generation Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_59_Insecure_Randomness_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Weak Random Number Generation Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Insufficiently Random\nValues{{/focus}}{{{nl}}}                 The software uses\ninsufficiently random numbers or values in a security context that\ndepends on unpredictable numbers.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Weak Random Number Generation{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/insecurerandomness$$LINK_DELIM$$Secure\nCode Warrior: Weak Random Number Generation Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_59_Insecure_Randomness_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Weak Random Number Generation Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Insufficiently Random\nValues{{/focus}}{{{nl}}}                 The software uses\ninsufficiently random numbers or values in a security context that\ndepends on unpredictable numbers.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Cryptography"
          }
        }, {
          "id" : "rails-http-only-disabled",
          "shortDescription" : "Rails HttpOnly Cookie Flag Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/1004.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/www-community/HttpOnly",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Rails HttpOnly Cookie Flag Disabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Rails HttpOnly Cookie Flag Disabled\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Rails HttpOnly Cookie Flag Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie Without\n'HttpOnly' Flag{{/focus}}{{{nl}}}                 The software uses a\ncookie to store sensitive information, but the cookie is not marked with\nthe HttpOnly flag.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Rails HttpOnly Cookie Flag Disabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Rails HttpOnly Cookie Flag Disabled\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Rails HttpOnly Cookie Flag Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie Without\n'HttpOnly' Flag{{/focus}}{{{nl}}}                 The software uses a\ncookie to store sensitive information, but the cookie is not marked with\nthe HttpOnly flag.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Session Management"
          }
        }, {
          "id" : "xxssprotection-header-disabled",
          "shortDescription" : "Response With X-XSS-Protection Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/79.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
            "custom references" : {
              "text" : "https://owasp.org/www-community/attacks/xss/\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/attacks/xss/{{{nl}}}"
            },
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response With X-XSS-Protection Disabled{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xss$$LINK_DELIM$$Secure\nCode Warrior: Response With X-XSS-Protection Disabled\nTraining{{/linkExternal}}     {{/listElement}} {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_71_Cross+Site+Scripting_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response With X-XSS-Protection Disabled\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}} {{#focus}}Improper\nNeutralization of Input During Web Page Generation ('Cross-site\nScripting'){{/focus}}{{{nl}}}                 The software does not\nneutralize or incorrectly neutralizes user-controllable input before it\nis placed in output that is used as a web page that is served to other\nusers.             {{/grayedData}}         {{/blockQuote}} {{!-- end SCW\nintegration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response With X-XSS-Protection Disabled{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xss$$LINK_DELIM$$Secure\nCode Warrior: Response With X-XSS-Protection Disabled\nTraining{{/linkExternal}}     {{/listElement}} {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_71_Cross+Site+Scripting_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response With X-XSS-Protection Disabled\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}} {{#focus}}Improper\nNeutralization of Input During Web Page Generation ('Cross-site\nScripting'){{/focus}}{{{nl}}}                 The software does not\nneutralize or incorrectly neutralizes user-controllable input before it\nis placed in output that is used as a web page that is served to other\nusers.             {{/grayedData}}         {{/blockQuote}} {{!-- end SCW\nintegration block --}}"
            },
            "category" : "XSS"
          }
        }, {
          "id" : "httponly",
          "shortDescription" : "Session Cookie Has No 'HttpOnly' Flag",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/1004.html",
            "likelihood" : "High",
            "references" : "https://owasp.org/www-community/HttpOnly",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Session Cookie Has No 'HttpOnly' Flag{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'HttpOnly' Flag\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'HttpOnly' Flag\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Sensitive Cookie Without 'HttpOnly' Flag{{/focus}}{{{nl}}}\nThe software uses a cookie to store sensitive information, but the\ncookie is not marked with the HttpOnly flag.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Session Cookie Has No 'HttpOnly' Flag{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'HttpOnly' Flag\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Session Cookie Has No 'HttpOnly' Flag\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Sensitive Cookie Without 'HttpOnly' Flag{{/focus}}{{{nl}}}\nThe software uses a cookie to store sensitive information, but the\ncookie is not marked with the HttpOnly flag.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Session Management"
          }
        }, {
          "id" : "prompt-injection",
          "shortDescription" : "Prompt Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/94.html",
            "likelihood" : "Medium",
            "references" : "",
            "owasp" : "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
            "impact" : "Medium",
            "confidence level" : 3,
            "category" : "Input Validation"
          }
        }, {
          "id" : "request-validation-control-disabled",
          "shortDescription" : "Request Validation Mode Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/20.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/hh882339.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Request Validation Mode Disabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Mode Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Mode Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Request Validation Mode Disabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Mode Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Mode Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "nosql-injection",
          "shortDescription" : "NoSQL Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/943.html",
            "likelihood" : "High",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_in_Java_Cheat_Sheet.html#nosql\nhttps://portswigger.net/web-security/nosql-injection",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}NoSQL Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/nosql$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_21_NoSQL_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nSpecial Elements in Data Query Logic{{/focus}}{{{nl}}}\nThe application generates a query intended to access or manipulate data\nin a data store such as a database, but it does not neutralize or\nincorrectly neutralizes special elements that can modify the intended\nlogic of the query.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}NoSQL Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/nosql$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_21_NoSQL_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nSpecial Elements in Data Query Logic{{/focus}}{{{nl}}}\nThe application generates a query intended to access or manipulate data\nin a data store such as a database, but it does not neutralize or\nincorrectly neutralizes special elements that can modify the intended\nlogic of the query.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "trace-enabled-aspx",
          "shortDescription" : "Tracing Enabled for ASPX",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/497.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/bb386420.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Tracing Enabled for ASPX{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled for ASPX Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled for ASPX Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure - Error\nDetails{{/focus}}{{{nl}}}                 Displaying too much\ninformation on why an error has occurred can lead to sensitive\ninformation exposure or provide information useful for an attacker to\nidentify or exploit another vulnerability.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Tracing Enabled for ASPX{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled for ASPX Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled for ASPX Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure - Error\nDetails{{/focus}}{{{nl}}}                 Displaying too much\ninformation on why an error has occurred can lead to sensitive\ninformation exposure or provide information useful for an attacker to\nidentify or exploit another vulnerability.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "session-regenerate",
          "shortDescription" : "Expired Session IDs Not Regenerated",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/384.html",
            "likelihood" : "Medium",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.sessionstatesection.regenerateexpiredsessionid.aspx",
            "owasp" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Expired Session IDs Not Regenerated{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/mobile/improper_session_handling/improper_timeout_of_session_id$$LINK_DELIM$$Secure\nCode Warrior: Expired Session IDs Not Regenerated\nTraining{{/linkExternal}}     {{/listElement}}   {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Improper Session Handling - Improper Timeout Of Session\nID{{/focus}}{{{nl}}}                 Improper session handling occurs\nwhen the session token is unintentionally shared with the adversary\nduring a subsequent transaction between the mobile app and the backend\nservers.  Once you are authenticated and given a session, that session\nallows one access to the mobile application. Mobile app code must\nprotect user sessions just as carefully as its authentication mechanism.\nAll sessions should implement an idle or inactivity timeout. This\ntimeout defines the amount of time a session will remain active in case\nthere is no activity in the session, closing and invalidating the\nsession upon the defined idle period since the last HTTP request\nreceived by the web application for a given session ID. This\nvulnerability occurs when there is no timeout set on the session ID\ngiven to the user, which means the user is logged in forever.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Expired Session IDs Not Regenerated{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/mobile/improper_session_handling/improper_timeout_of_session_id$$LINK_DELIM$$Secure\nCode Warrior: Expired Session IDs Not Regenerated\nTraining{{/linkExternal}}     {{/listElement}}   {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Improper Session Handling - Improper Timeout Of Session\nID{{/focus}}{{{nl}}}                 Improper session handling occurs\nwhen the session token is unintentionally shared with the adversary\nduring a subsequent transaction between the mobile app and the backend\nservers.  Once you are authenticated and given a session, that session\nallows one access to the mobile application. Mobile app code must\nprotect user sessions just as carefully as its authentication mechanism.\nAll sessions should implement an idle or inactivity timeout. This\ntimeout defines the amount of time a session will remain active in case\nthere is no activity in the session, closing and invalidating the\nsession upon the defined idle period since the last HTTP request\nreceived by the web application for a given session ID. This\nvulnerability occurs when there is no timeout set on the session ID\ngiven to the user, which means the user is logged in forever.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Session Management"
          }
        }, {
          "id" : "trace-enabled",
          "shortDescription" : "Tracing Enabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/497.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/bb386420.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Tracing Enabled{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure - Error\nDetails{{/focus}}{{{nl}}}                 Displaying too much\ninformation on why an error has occurred can lead to sensitive\ninformation exposure or provide information useful for an attacker to\nidentify or exploit another vulnerability.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Tracing Enabled{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Tracing Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure - Error\nDetails{{/focus}}{{{nl}}}                 Displaying too much\ninformation on why an error has occurred can lead to sensitive\ninformation exposure or provide information useful for an attacker to\nidentify or exploit another vulnerability.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "csp-header-missing",
          "shortDescription" : "Response Without Content-Security-Policy Header",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/602.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/www-community/controls/Content_Security_Policy",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html",
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response Without Content-Security-Policy Header{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Response Without Content-Security-Policy Header\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response Without Content-Security-Policy Header\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Disabled Security\nFeatures{{/focus}}{{{nl}}}                 This vulnerability refers to\na mistake or lack of environment identification capabilities that could\nlead to certain security features being disabled (e.g.: access-control).\nHaving such features disabled in a production environment would leave an\napplication running exclusively on security-through-obscurity (simply\nhiding menu options and such like) that should not be considered of\nsecurity value.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response Without Content-Security-Policy Header{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Response Without Content-Security-Policy Header\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response Without Content-Security-Policy Header\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Disabled Security\nFeatures{{/focus}}{{{nl}}}                 This vulnerability refers to\na mistake or lack of environment identification capabilities that could\nlead to certain security features being disabled (e.g.: access-control).\nHaving such features disabled in a production environment would leave an\napplication running exclusively on security-through-obscurity (simply\nhiding menu options and such like) that should not be considered of\nsecurity value.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "log-injection",
          "shortDescription" : "Log Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/93.html",
            "likelihood" : "Low",
            "references" : "",
            "owasp" : "https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/",
            "custom references" : {
              "text" : "https://owasp.org/www-community/attacks/Log_Injection\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/attacks/Log_Injection{{{nl}}}"
            },
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Log Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/log$$LINK_DELIM$$Secure\nCode Warrior: Log Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_153_log_forging.mp4$$LINK_DELIM$$Secure\nCode Warrior: Log Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of CRLF Sequences ('CRLF\nInjection'){{/focus}}{{{nl}}}                 The software uses CRLF\n(carriage return line feeds) as a special element, e.g. to separate\nlines or records, but it does not neutralize or incorrectly neutralizes\nCRLF sequences from inputs. {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Log Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/log$$LINK_DELIM$$Secure\nCode Warrior: Log Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_153_log_forging.mp4$$LINK_DELIM$$Secure\nCode Warrior: Log Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of CRLF Sequences ('CRLF\nInjection'){{/focus}}{{{nl}}}                 The software uses CRLF\n(carriage return line feeds) as a special element, e.g. to separate\nlines or records, but it does not neutralize or incorrectly neutralizes\nCRLF sequences from inputs. {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "wcf-detect-replays",
          "shortDescription" : "WCF Replay Detection Not Enabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/200.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/aa738652(v=vs.110).aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "custom references" : {
              "text" : "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure\nhttps://owasp.org/www-project-proactive-controls/v3/en/c8-protect-data-everywhere\nhttps://owasp.org/Top10/A02_2021-Cryptographic_Failures/\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure{{{nl}}}https://owasp.org/www-project-proactive-controls/v3/en/c8-protect-data-everywhere{{{nl}}}https://owasp.org/Top10/A02_2021-Cryptographic_Failures/{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}WCF Replay Detection Not Enabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: WCF Replay Detection Not Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_57_sensitive_data_exposure.mp4$$LINK_DELIM$$Secure\nCode Warrior: WCF Replay Detection Not Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Exposure of Sensitive\nInformation to an Unauthorized Actor{{/focus}}{{{nl}}} The product\nexposes sensitive information to an actor that is not explicitly\nauthorized to have access to that information. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}WCF Replay Detection Not Enabled{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: WCF Replay Detection Not Enabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_57_sensitive_data_exposure.mp4$$LINK_DELIM$$Secure\nCode Warrior: WCF Replay Detection Not Enabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Exposure of Sensitive\nInformation to an Unauthorized Actor{{/focus}}{{{nl}}} The product\nexposes sensitive information to an actor that is not explicitly\nauthorized to have access to that information. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "crypto-bad-ciphers",
          "shortDescription" : "Insecure Encryption Algorithms",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/327.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/\nhttps://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
            "custom references" : {
              "text" : "https://owasp.org/www-community/vulnerabilities/Using_a_broken_or_risky_cryptographic_algorithm\nhttps://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\nhttps://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/vulnerabilities/Using_a_broken_or_risky_cryptographic_algorithm{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure Encryption Algorithms{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/algorithm$$LINK_DELIM$$Secure\nCode Warrior: Insecure Encryption Algorithms Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_78_weak_crypto_algorithm.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure Encryption Algorithms Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of a Broken or Risky\nCryptographic Algorithm{{/focus}}{{{nl}}}                 The use of a\nbroken or risky cryptographic algorithm is an unnecessary risk that may\nresult in the exposure of sensitive information. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure Encryption Algorithms{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/algorithm$$LINK_DELIM$$Secure\nCode Warrior: Insecure Encryption Algorithms Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_78_weak_crypto_algorithm.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure Encryption Algorithms Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of a Broken or Risky\nCryptographic Algorithm{{/focus}}{{{nl}}}                 The use of a\nbroken or risky cryptographic algorithm is an unnecessary risk that may\nresult in the exposure of sensitive information. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Cryptography"
          }
        }, {
          "id" : "http-only-disabled",
          "shortDescription" : "HttpOnly Cookie Flag Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/1004.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/www-community/HttpOnly",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}HttpOnly Cookie Flag Disabled{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: HttpOnly Cookie Flag Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: HttpOnly Cookie Flag Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie Without\n'HttpOnly' Flag{{/focus}}{{{nl}}}                 The software uses a\ncookie to store sensitive information, but the cookie is not marked with\nthe HttpOnly flag.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}HttpOnly Cookie Flag Disabled{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: HttpOnly Cookie Flag Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: HttpOnly Cookie Flag Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Sensitive Cookie Without\n'HttpOnly' Flag{{/focus}}{{{nl}}}                 The software uses a\ncookie to store sensitive information, but the cookie is not marked with\nthe HttpOnly flag.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Session Management"
          }
        }, {
          "id" : "authorization-missing-deny",
          "shortDescription" : "Authorization Rules Missing Deny Rule",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/294.html",
            "likelihood" : "Medium",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.authorizationsection.aspx",
            "owasp" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "custom references" : {
              "text" : "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 2,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Authorization Rules Missing Deny Rule{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/missingauth$$LINK_DELIM$$Secure\nCode Warrior: Authorization Rules Missing Deny Rule\nTraining{{/linkExternal}}     {{/listElement}} {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_128_improper_authentication.mp4$$LINK_DELIM$$Secure\nCode Warrior: Authorization Rules Missing Deny Rule\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}} {{#focus}}Authentication\nBypass by Capture-replay{{/focus}}{{{nl}}} A capture-replay flaw exists\nwhen the design of the software makes it possible for a malicious user\nto sniff network traffic and bypass authentication by replaying it to\nthe server in question to the same effect as the original message (or\nwith minor changes). {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Authorization Rules Missing Deny Rule{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/missingauth$$LINK_DELIM$$Secure\nCode Warrior: Authorization Rules Missing Deny Rule\nTraining{{/linkExternal}}     {{/listElement}} {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_128_improper_authentication.mp4$$LINK_DELIM$$Secure\nCode Warrior: Authorization Rules Missing Deny Rule\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}} {{#focus}}Authentication\nBypass by Capture-replay{{/focus}}{{{nl}}} A capture-replay flaw exists\nwhen the design of the software makes it possible for a malicious user\nto sniff network traffic and bypass authentication by replaying it to\nthe server in question to the same effect as the original message (or\nwith minor changes). {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "forms-auth-protection",
          "shortDescription" : "Forms Auth Protection Mode",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/601.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.formsauthenticationconfiguration.protection.aspx",
            "owasp" : "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Auth Protection Mode{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Forms Auth Protection Mode Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Auth Protection Mode Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}URL Redirection to Untrusted\nSite ('Open Redirect'){{/focus}}{{{nl}}}                 A web\napplication accepts a user-controlled input that specifies a link to an\nexternal site, and uses that link in a Redirect. This simplifies\nphishing attacks.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Auth Protection Mode{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Forms Auth Protection Mode Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Auth Protection Mode Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}URL Redirection to Untrusted\nSite ('Open Redirect'){{/focus}}{{{nl}}}                 A web\napplication accepts a user-controlled input that specifies a link to an\nexternal site, and uses that link in a Redirect. This simplifies\nphishing attacks.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Authentication"
          }
        }, {
          "id" : "header-checking-disabled",
          "shortDescription" : "Header Checking Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/756.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.httpruntimesection.enableheaderchecking.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Header Checking Disabled{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Header Checking Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Header Checking Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Custom Error\nPage{{/focus}}{{{nl}}}                 The software does not return\ncustom error pages to the user, possibly exposing sensitive information.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Header Checking Disabled{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Header Checking Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Header Checking Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Custom Error\nPage{{/focus}}{{{nl}}}                 The software does not return\ncustom error pages to the user, possibly exposing sensitive information.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "spring-unchecked-autobinding",
          "shortDescription" : "Unchecked Spring Autobinding",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/915.html",
            "likelihood" : "Low",
            "references" : "",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html",
            "impact" : "High",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unchecked Spring Autobinding{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/mass_assignment/generic$$LINK_DELIM$$Secure\nCode Warrior: Unchecked Spring Autobinding Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_138_mass_assignment.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unchecked Spring Autobinding Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improperly Controlled\nModification of Dynamically-Determined Object\nAttributes{{/focus}}{{{nl}}}                 The software receives input\nfrom an upstream component that specifies multiple attributes,\nproperties, or fields that are to be initialized or updated in an\nobject, but it does not properly control which attributes can be\nmodified.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unchecked Spring Autobinding{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/mass_assignment/generic$$LINK_DELIM$$Secure\nCode Warrior: Unchecked Spring Autobinding Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_138_mass_assignment.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unchecked Spring Autobinding Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improperly Controlled\nModification of Dynamically-Determined Object\nAttributes{{/focus}}{{{nl}}}                 The software receives input\nfrom an upstream component that specifies multiple attributes,\nproperties, or fields that are to be initialized or updated in an\nobject, but it does not properly control which attributes can be\nmodified.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "weak-membership-config",
          "shortDescription" : "Weak Membership Configuration",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/307.html",
            "likelihood" : "Medium",
            "references" : "https://msdn.microsoft.com/en-us/library/System.Web.Security.Membership.aspx",
            "owasp" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "impact" : "Low",
            "confidence level" : 2,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Weak Membership Configuration{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/antiautomation$$LINK_DELIM$$Secure\nCode Warrior: Weak Membership Configuration Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/SCW Module 20 -\nInsufficient Anti-Automation.mp4$$LINK_DELIM$$Secure Code Warrior: Weak\nMembership Configuration Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Restriction of\nExcessive Authentication Attempts{{/focus}}{{{nl}}}                 The\nsoftware does not implement sufficient measures to prevent multiple\nfailed authentication attempts within in a short time frame, making it\nmore susceptible to brute force attacks.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Weak Membership Configuration{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/antiautomation$$LINK_DELIM$$Secure\nCode Warrior: Weak Membership Configuration Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/SCW Module 20 -\nInsufficient Anti-Automation.mp4$$LINK_DELIM$$Secure Code Warrior: Weak\nMembership Configuration Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Restriction of\nExcessive Authentication Attempts{{/focus}}{{{nl}}}                 The\nsoftware does not implement sufficient measures to prevent multiple\nfailed authentication attempts within in a short time frame, making it\nmore susceptible to brute force attacks.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Authentication"
          }
        }, {
          "id" : "xpath-injection",
          "shortDescription" : "XPath Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/643.html",
            "likelihood" : "High",
            "references" : "https://owasp.org/www-community/attacks/XPATH_Injection",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://wiki.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010)\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://wiki.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010){{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}XPath Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/xpath$$LINK_DELIM$$Secure\nCode Warrior: XPath Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/XPath+and+XML+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: XPath Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Data within XPath Expressions\n('XPath Injection'){{/focus}}{{{nl}}} The software uses external input\nto dynamically construct an XPath expression used to retrieve data from\nan XML database, but it does not neutralize or incorrectly neutralizes\nthat input. This allows an attacker to control the structure of the\nquery. {{/grayedData}}         {{/blockQuote}}  {{!-- end SCW\nintegration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}XPath Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/xpath$$LINK_DELIM$$Secure\nCode Warrior: XPath Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/XPath+and+XML+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: XPath Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Data within XPath Expressions\n('XPath Injection'){{/focus}}{{{nl}}} The software uses external input\nto dynamically construct an XPath expression used to retrieve data from\nan XML database, but it does not neutralize or incorrectly neutralizes\nthat input. This allows an attacker to control the structure of the\nquery. {{/grayedData}}         {{/blockQuote}}  {{!-- end SCW\nintegration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "overly-permissive-cross-domain-policy",
          "shortDescription" : "Overly Permissive Cross Domain Policy",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/942.html",
            "likelihood" : "High",
            "references" : "https://cseweb.ucsd.edu/~hovav/dist/crossdomain.pdf\nhttps://www.ics.forth.gr/_publications/crossdomainxml_eurosec11.pdf",
            "owasp" : "https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny",
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Overly Permissive Cross Domain Policy{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Overly Permissive Cross Domain Policy\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Overly Permissive Cross Domain Policy\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Disabled Security\nFeatures{{/focus}}{{{nl}}}                 This vulnerability refers to\na mistake or lack of environment identification capabilities that could\nlead to certain security features being disabled (e.g.: access-control).\nHaving such features disabled in a production environment would leave an\napplication running exclusively on security-through-obscurity (simply\nhiding menu options and such like) that should not be considered of\nsecurity value.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Overly Permissive Cross Domain Policy{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Overly Permissive Cross Domain Policy\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Overly Permissive Cross Domain Policy\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Disabled Security\nFeatures{{/focus}}{{{nl}}}                 This vulnerability refers to\na mistake or lack of environment identification capabilities that could\nlead to certain security features being disabled (e.g.: access-control).\nHaving such features disabled in a production environment would leave an\napplication running exclusively on security-through-obscurity (simply\nhiding menu options and such like) that should not be considered of\nsecurity value.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "custom-errors-off",
          "shortDescription" : "Detailed Error Messages Displayed",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/756.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/y123fsf7.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Detailed Error Messages Displayed{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Detailed Error Messages Displayed\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Detailed Error Messages Displayed Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Custom Error\nPage{{/focus}}{{{nl}}}                 The software does not return\ncustom error pages to the user, possibly exposing sensitive information.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Detailed Error Messages Displayed{{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/errordetails$$LINK_DELIM$$Secure\nCode Warrior: Detailed Error Messages Displayed\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_184_error_details.mp4$$LINK_DELIM$$Secure\nCode Warrior: Detailed Error Messages Displayed Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Custom Error\nPage{{/focus}}{{{nl}}}                 The software does not return\ncustom error pages to the user, possibly exposing sensitive information.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Error Handling"
          }
        }, {
          "id" : "insecure-socket-factory",
          "shortDescription" : "Insecure SSL Socket Creation",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/319.html",
            "likelihood" : "High",
            "references" : "https://en.wikipedia.org/wiki/Server_Name_Indication",
            "owasp" : "https://wiki.owasp.org/index.php/SSL_TLS_Knowledge_Center",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure SSL Socket Creation{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Insecure SSL Socket Creation Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure SSL Socket Creation Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure SSL Socket Creation{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/itlp/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: Insecure SSL Socket Creation Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_200_unprotected_transport_of_sensitive_information.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure SSL Socket Creation Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cleartext Transmission of\nSensitive Information{{/focus}}{{{nl}}}                 The software\ntransmits sensitive or security-critical data in cleartext in a\ncommunication channel that can be sniffed by unauthorized actors.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Secure Communications"
          }
        }, {
          "id" : "plaintext-conn-strings",
          "shortDescription" : "Unprotected Connection Strings",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/13.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/53tyfkaw.aspx\nhttps://msdn.microsoft.com/en-us/library/ms254494.aspx\nhttps://msdn.microsoft.com/en-us/library/ff647398.aspx",
            "owasp" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unprotected Connection Strings{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/mobile/insecure_authentication/hardcoded_api_keys$$LINK_DELIM$$Secure\nCode Warrior: Unprotected Connection Strings Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_95_HARDCODED_API_KEYS_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unprotected Connection Strings Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Insecure Authentication -\nHardcoded API Keys{{/focus}}{{{nl}}}                 Poor or missing\nauthentication/authorization schemes allow an adversary to anonymously\nexecute functionality within the mobile app or backend server used by\nthe mobile app. Weaker authentication for mobile apps is fairly\nprevalent due to a mobile device's input form factor. To detect poor\nauthentication schemes, testers can perform binary attacks against the\nmobile app while it is in 'offline' mode. Through the attack, the tester\nwill force the app to bypass offline authentication and then execute\nfunctionality that should require offline authentication. To test for\npoor authorization schemes, testers can perform binary attacks against\nthe mobile app and try to execute privileged functionality that should\nonly be executable with a user of higher privilege while the mobile app\nis in 'offline' mode.  This kind of vulnerability occurs when the app\nuses a hardcoded API key to communicate to the server. It is possible\nfor an attacker to use the API key and make direct calls to the server.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unprotected Connection Strings{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/mobile/insecure_authentication/hardcoded_api_keys$$LINK_DELIM$$Secure\nCode Warrior: Unprotected Connection Strings Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_95_HARDCODED_API_KEYS_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unprotected Connection Strings Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Insecure Authentication -\nHardcoded API Keys{{/focus}}{{{nl}}}                 Poor or missing\nauthentication/authorization schemes allow an adversary to anonymously\nexecute functionality within the mobile app or backend server used by\nthe mobile app. Weaker authentication for mobile apps is fairly\nprevalent due to a mobile device's input form factor. To detect poor\nauthentication schemes, testers can perform binary attacks against the\nmobile app while it is in 'offline' mode. Through the attack, the tester\nwill force the app to bypass offline authentication and then execute\nfunctionality that should require offline authentication. To test for\npoor authorization schemes, testers can perform binary attacks against\nthe mobile app and try to execute privileged functionality that should\nonly be executable with a user of higher privilege while the mobile app\nis in 'offline' mode.  This kind of vulnerability occurs when the app\nuses a hardcoded API key to communicate to the server. It is possible\nfor an attacker to use the API key and make direct calls to the server.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "insecure-jsp-access",
          "shortDescription" : "Insecure JSP Placement",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/219.html",
            "likelihood" : "Medium",
            "references" : "https://wiki.owasp.org/index.php/Insecure_Configuration_Management",
            "owasp" : "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
            "impact" : "Medium",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure JSP Placement{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/misconfig$$LINK_DELIM$$Secure\nCode Warrior: Insecure JSP Placement Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_81_SECURITY_MISCONFIGURATION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure JSP Placement Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure -\nSecurity Misconfiguration{{/focus}}{{{nl}}}                 Information\nexposure can occur as a result of security misconfiguration, typically\ndue to poor or no security configuration. Common examples of this\ninclude accidental deployment of test environment configuration to\nproduction systems, lack of error handling configured resulting in full\nerror details being shown to users, and poor directory configuration\nallowing files to be accessible when they should not be.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure JSP Placement{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/misconfig$$LINK_DELIM$$Secure\nCode Warrior: Insecure JSP Placement Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_81_SECURITY_MISCONFIGURATION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure JSP Placement Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Information Exposure -\nSecurity Misconfiguration{{/focus}}{{{nl}}}                 Information\nexposure can occur as a result of security misconfiguration, typically\ndue to poor or no security configuration. Common examples of this\ninclude accidental deployment of test environment configuration to\nproduction systems, lack of error handling configured resulting in full\nerror details being shown to users, and poor directory configuration\nallowing files to be accessible when they should not be.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "ssrf",
          "shortDescription" : "Server-Side Request Forgery (SSRF)",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/918.html",
            "likelihood" : "Medium",
            "references" : "https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit?pli=1#",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html",
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Server-Side Request Forgery (SSRF){{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/ssrf/generic$$LINK_DELIM$$Secure\nCode Warrior: Server-Side Request Forgery (SSRF)\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_125_server_side_request_forgery.mp4$$LINK_DELIM$$Secure\nCode Warrior: Server-Side Request Forgery (SSRF) Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Server-Side Request Forgery\n(SSRF){{/focus}}{{{nl}}}                 The web server receives a URL\nor similar request from an upstream component and retrieves the contents\nof this URL, but it does not sufficiently ensure that the request is\nbeing sent to the expected destination.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Server-Side Request Forgery (SSRF){{/focus}} vulnerabilities\nover on the Secure Code Warrior platform by watching videos and\ncompleting training exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/ssrf/generic$$LINK_DELIM$$Secure\nCode Warrior: Server-Side Request Forgery (SSRF)\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_125_server_side_request_forgery.mp4$$LINK_DELIM$$Secure\nCode Warrior: Server-Side Request Forgery (SSRF) Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Server-Side Request Forgery\n(SSRF){{/focus}}{{{nl}}}                 The web server receives a URL\nor similar request from an upstream component and retrieves the contents\nof this URL, but it does not sufficiently ensure that the request is\nbeing sent to the expected destination.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "sql-injection",
          "shortDescription" : "SQL Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/89.html",
            "likelihood" : "High",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://owasp.org/www-community/attacks/SQL_Injection\nhttps://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/attacks/SQL_Injection{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}SQL Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/sql$$LINK_DELIM$$Secure\nCode Warrior: SQL Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_01_sql_injection.mp4$$LINK_DELIM$$Secure\nCode Warrior: SQL Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements used in an SQL\nCommand ('SQL Injection'){{/focus}}{{{nl}}}                 The software\nconstructs all or part of an SQL command using externally-influenced\ninput from an upstream component, but it does not neutralize or\nincorrectly neutralizes special elements that could modify the intended\nSQL command when it is sent to a downstream component. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}{{!-- begin\nSecureFlag integration block --}}      {{#header}}Secure Flag\n{{#omitted}} Integration{{/omitted}}{{/header}}     {{#paragraph}}Learn\nmore about {{#focus}}SQL Injection{{/focus}} vulnerabilities over on the\nSecure Flag platform by reading knowledge base articles and completing\ntraining labs that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://knowledge-base.secureflag.com/vulnerabilities/sql_injection/sql_injection_vulnerability.html$$LINK_DELIM$$Secure\nFlag Knowledge Base: SQL Injection{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}http://www.secureflag.com/go.html?uuid=41bebff2-aa14-477c-b49b-706a064449ff$$LINK_DELIM$$Secure\nFlag Lab: Authentication Bypass via SQL Injection at Sign\nIn{{/linkExternal}}             {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}http://www.secureflag.com/go.html?uuid=29d0d708-71eb-4c33-9029-b56d8562e122$$LINK_DELIM$$Secure\nFlag Lab: Authentication Bypass via SQL Injection in Login\nForm{{/linkExternal}}             {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}http://www.secureflag.com/go.html?uuid=8e1f3056-32a3-4382-943a-6956ff93f4dc$$LINK_DELIM$$Secure\nFlag Lab: SQL Injection in Basic Authentication{{/linkExternal}}\n{{/listElement}}       {{/unorderedList}} {{!-- end SecureFlag\nintegration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}SQL Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/sql$$LINK_DELIM$$Secure\nCode Warrior: SQL Injection Training{{/linkExternal}} {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_01_sql_injection.mp4$$LINK_DELIM$$Secure\nCode Warrior: SQL Injection Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements used in an SQL\nCommand ('SQL Injection'){{/focus}}{{{nl}}}                 The software\nconstructs all or part of an SQL command using externally-influenced\ninput from an upstream component, but it does not neutralize or\nincorrectly neutralizes special elements that could modify the intended\nSQL command when it is sent to a downstream component. {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}{{!-- begin\nSecureFlag integration block --}}      {{#header}}Secure Flag\n{{#omitted}} Integration{{/omitted}}{{/header}}     {{#paragraph}}Learn\nmore about {{#focus}}SQL Injection{{/focus}} vulnerabilities over on the\nSecure Flag platform by reading knowledge base articles and completing\ntraining labs that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://knowledge-base.secureflag.com/vulnerabilities/sql_injection/sql_injection_vulnerability.html$$LINK_DELIM$$Secure\nFlag Knowledge Base: SQL Injection{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}http://www.secureflag.com/go.html?uuid=41bebff2-aa14-477c-b49b-706a064449ff$$LINK_DELIM$$Secure\nFlag Lab: Authentication Bypass via SQL Injection at Sign\nIn{{/linkExternal}}             {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}http://www.secureflag.com/go.html?uuid=29d0d708-71eb-4c33-9029-b56d8562e122$$LINK_DELIM$$Secure\nFlag Lab: Authentication Bypass via SQL Injection in Login\nForm{{/linkExternal}}             {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}http://www.secureflag.com/go.html?uuid=8e1f3056-32a3-4382-943a-6956ff93f4dc$$LINK_DELIM$$Secure\nFlag Lab: SQL Injection in Basic Authentication{{/linkExternal}}\n{{/listElement}}       {{/unorderedList}} {{!-- end SecureFlag\nintegration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "clickjacking-control-missing",
          "shortDescription" : "Pages Without Anti-Clickjacking Controls",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/693.html",
            "likelihood" : "Low",
            "references" : "https://en.wikipedia.org/wiki/Clickjacking\nhttps://www.w3.org/Security/wiki/Clickjacking_Threats\nhttps://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01",
            "owasp" : "https://owasp.org/www-community/attacks/Clickjacking",
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Pages Without Anti-Clickjacking Controls{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/clickjack$$LINK_DELIM$$Secure\nCode Warrior: Pages Without Anti-Clickjacking Controls\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_25_CLICKJACKING_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Pages Without Anti-Clickjacking Controls\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Clickjacking{{/focus}}{{{nl}}}\nClickjacking, which is also called UI redressing, is a trick which\nplaces an invisible panel or an identical control overlay in front of an\nexisting application. The user clicking on that control or page is then\nused to perform some other action on behalf of that user i.e. Liking a\nsocial media page or posting a tweet. The click is then also passed on\nto the underlying application and the user is unaware that their\nidentity has been misused.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Pages Without Anti-Clickjacking Controls{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/clickjack$$LINK_DELIM$$Secure\nCode Warrior: Pages Without Anti-Clickjacking Controls\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_25_CLICKJACKING_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Pages Without Anti-Clickjacking Controls\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Clickjacking{{/focus}}{{{nl}}}\nClickjacking, which is also called UI redressing, is a trick which\nplaces an invisible panel or an identical control overlay in front of an\nexisting application. The user clicking on that control or page is then\nused to perform some other action on behalf of that user i.e. Liking a\nsocial media page or posting a tweet. The click is then also passed on\nto the underlying application and the user is unaware that their\nidentity has been misused.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Authentication"
          }
        }, {
          "id" : "parameter-pollution",
          "shortDescription" : "Parameter Pollution",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/235.html",
            "likelihood" : "Low",
            "references" : "https://download.oracle.com/javaee-archive/servlet-spec.java.net/jsr340-experts/att-0317/OnParameterPollutionAttacks.pdf\nhttps://www.owasp.org/images/b/ba/AppsecEU09_CarettoniDiPaola_v0.8.pdf",
            "owasp" : "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution",
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Parameter Pollution{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/blog/validation$$LINK_DELIM$$Secure\nCode Warrior: Parameter Pollution Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_152_insufficient_validation.mp4$$LINK_DELIM$$Secure\nCode Warrior: Parameter Pollution Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Business Logic - Insufficient\nValidation{{/focus}}{{{nl}}}                 Insufficient validation of\ninput parameters in any API can lead to critical failures which may\neither halt services or allow attackers to gain access to privileged\ninformation and misuse business functions. Using undocumented or hidden\ninput values may provide an attacker with the means to damage and/or\ninfiltrate a web based service through the use of carefully crafted\ncalls. Another form of attack may be to send data which is designed to\ncause services and/or indeed whole servers to crash.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Parameter Pollution{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/blog/validation$$LINK_DELIM$$Secure\nCode Warrior: Parameter Pollution Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_152_insufficient_validation.mp4$$LINK_DELIM$$Secure\nCode Warrior: Parameter Pollution Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Business Logic - Insufficient\nValidation{{/focus}}{{{nl}}}                 Insufficient validation of\ninput parameters in any API can lead to critical failures which may\neither halt services or allow attackers to gain access to privileged\ninformation and misuse business functions. Using undocumented or hidden\ninput values may provide an attacker with the means to damage and/or\ninfiltrate a web based service through the use of carefully crafted\ncalls. Another form of attack may be to send data which is designed to\ncause services and/or indeed whole servers to crash.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Caching"
          }
        }, {
          "id" : "reflected-xss",
          "shortDescription" : "Cross-Site Scripting",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/79.html",
            "likelihood" : "Medium",
            "references" : "",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
            "custom references" : {
              "text" : "https://owasp.org/www-community/attacks/xss/\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/attacks/xss/{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cross-Site Scripting{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xss$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Scripting Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_71_Cross+Site+Scripting_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Scripting Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nInput During Web Page Generation ('Cross-site\nScripting'){{/focus}}{{{nl}}}                 The software does not\nneutralize or incorrectly neutralizes user-controllable input before it\nis placed in output that is used as a web page that is served to other\nusers.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cross-Site Scripting{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/xss$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Scripting Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_71_Cross+Site+Scripting_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Scripting Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nInput During Web Page Generation ('Cross-site\nScripting'){{/focus}}{{{nl}}}                 The software does not\nneutralize or incorrectly neutralizes user-controllable input before it\nis placed in output that is used as a web page that is served to other\nusers.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}"
            },
            "category" : "XSS"
          }
        }, {
          "id" : "session-timeout",
          "shortDescription" : "Overly Long Session Timeout",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/613.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "owasp" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "custom references" : {
              "text" : "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Overly Long Session Timeout{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/session/sessionexp$$LINK_DELIM$$Secure\nCode Warrior: Overly Long Session Timeout Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_137_insufficient_session_expiration.mp4$$LINK_DELIM$$Secure\nCode Warrior: Overly Long Session Timeout Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Insufficient Session\nExpiration{{/focus}}{{{nl}}}                 According to WASC,\nInsufficient Session Expiration is when a web site permits an attacker\nto reuse old session credentials or session IDs for authorization.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Overly Long Session Timeout{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/session/sessionexp$$LINK_DELIM$$Secure\nCode Warrior: Overly Long Session Timeout Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_137_insufficient_session_expiration.mp4$$LINK_DELIM$$Secure\nCode Warrior: Overly Long Session Timeout Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Insufficient Session\nExpiration{{/focus}}{{{nl}}}                 According to WASC,\nInsufficient Session Expiration is when a web site permits an attacker\nto reuse old session credentials or session IDs for authorization.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Session Management"
          }
        }, {
          "id" : "cookie-flags-missing",
          "shortDescription" : "Application Disables ''secure'' Flag on Cookies",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/614.html",
            "likelihood" : "High",
            "references" : "https://owasp.org/www-community/controls/SecureCookieAttribute",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Application Disables ''secure'' Flag on Cookies{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Application Disables ''secure'' Flag on Cookies\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Application Disables ''secure'' Flag on Cookies\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Sensitive Cookie in HTTPS Session Without 'Secure'\nAttribute{{/focus}}{{{nl}}}                 The Secure attribute for\nsensitive cookies in HTTPS sessions is not set, which could cause the\nuser agent to send those cookies in plaintext over an HTTP session.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Application Disables ''secure'' Flag on Cookies{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Application Disables ''secure'' Flag on Cookies\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Application Disables ''secure'' Flag on Cookies\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Sensitive Cookie in HTTPS Session Without 'Secure'\nAttribute{{/focus}}{{{nl}}}                 The Secure attribute for\nsensitive cookies in HTTPS sessions is not set, which could cause the\nuser agent to send those cookies in plaintext over an HTTP session.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Secure Communications"
          }
        }, {
          "id" : "csp-header-insecure",
          "shortDescription" : "Response With Insecurely Configured Content-Security-Policy Header",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/602.html",
            "likelihood" : "Low",
            "references" : "https://owasp.org/www-community/controls/Content_Security_Policy",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html",
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response With Insecurely Configured Content-Security-Policy\nHeader{{/focus}} vulnerabilities over on the Secure Code Warrior\nplatform by watching videos and completing training exercises and\nmissions that focus on secure coding.{{/paragraph}}  {{#unorderedList}}\n{{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nContent-Security-Policy Header Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nContent-Security-Policy Header Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response With Insecurely Configured Content-Security-Policy\nHeader{{/focus}} vulnerabilities over on the Secure Code Warrior\nplatform by watching videos and completing training exercises and\nmissions that focus on secure coding.{{/paragraph}}  {{#unorderedList}}\n{{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nContent-Security-Policy Header Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response With Insecurely Configured\nContent-Security-Policy Header Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "nosql-injection-dynamodb",
          "shortDescription" : "NoSQL Injection DynamoDB",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/943.html",
            "likelihood" : "High",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_in_Java_Cheat_Sheet.html#nosql",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}NoSQL Injection DynamoDB{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/nosql$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection DynamoDB Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_21_NoSQL_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection DynamoDB Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nSpecial Elements in Data Query Logic{{/focus}}{{{nl}}}\nThe application generates a query intended to access or manipulate data\nin a data store such as a database, but it does not neutralize or\nincorrectly neutralizes special elements that can modify the intended\nlogic of the query.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}NoSQL Injection DynamoDB{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/nosql$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection DynamoDB Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_21_NoSQL_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: NoSQL Injection DynamoDB Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nSpecial Elements in Data Query Logic{{/focus}}{{{nl}}}\nThe application generates a query intended to access or manipulate data\nin a data store such as a database, but it does not neutralize or\nincorrectly neutralizes special elements that can modify the intended\nlogic of the query.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "hardcoded-password",
          "shortDescription" : "Hardcoded Password",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/259.html",
            "likelihood" : "Low",
            "references" : "https://www.securecoding.cert.org/confluence/display/java/MSC03-J.+Never+hard+code+sensitive+information\nhttps://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html\nhttps://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password",
            "owasp" : "https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password",
            "impact" : "High",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Hardcoded Password{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/credentialexp$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Password Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_198_insufficiently_protected_credentials.mp4$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Password Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Hard-coded\nPassword{{/focus}}{{{nl}}}                 The software contains a\nhard-coded password, which it uses for its own inbound authentication or\nfor outbound communication to external components.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Hardcoded Password{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/auth/credentialexp$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Password Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_198_insufficiently_protected_credentials.mp4$$LINK_DELIM$$Secure\nCode Warrior: Hardcoded Password Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Hard-coded\nPassword{{/focus}}{{{nl}}}                 The software contains a\nhard-coded password, which it uses for its own inbound authentication or\nfor outbound communication to external components.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Cryptography"
          }
        }, {
          "id" : "cache-control-disabled",
          "shortDescription" : "Cache Control Header Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/525.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.httpruntimesection.sendcachecontrolheader.aspx",
            "owasp" : "https://owasp.org/Top10/A04_2021-Insecure_Design/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cache Control Header Disabled{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/sidechannel/url_cache$$LINK_DELIM$$Secure\nCode Warrior: Cache Control Header Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_193_url_caching.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cache Control Header Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Web Browser Cache\nContaining Sensitive Information{{/focus}}{{{nl}}}                 The\nweb application does not use an appropriate caching policy that\nspecifies the extent to which each web page and associated form fields\nshould be cached.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cache Control Header Disabled{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/sidechannel/url_cache$$LINK_DELIM$$Secure\nCode Warrior: Cache Control Header Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_193_url_caching.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cache Control Header Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Web Browser Cache\nContaining Sensitive Information{{/focus}}{{{nl}}}                 The\nweb application does not use an appropriate caching policy that\nspecifies the extent to which each web page and associated form fields\nshould be cached.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "jndi-injection",
          "shortDescription" : "JNDI Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/74.html",
            "likelihood" : "High",
            "references" : "https://owasp.org/Top10/A03_2021-Injection/",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html\nhttps://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html\nhttps://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html{{{nl}}}https://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs{{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}JNDI Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection$$LINK_DELIM$$Secure\nCode Warrior: JNDI Injection Training{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements in Output Used by\na Downstream Component ('Injection'){{/focus}}{{{nl}}}\nThe software constructs all or part of a command, data structure, or\nrecord using externally-influenced input from an upstream component, but\nit does not neutralize or incorrectly neutralizes special elements that\ncould modify how it is parsed or interpreted when it is sent to a\ndownstream component.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}JNDI Injection{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection$$LINK_DELIM$$Secure\nCode Warrior: JNDI Injection Training{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Improper Neutralization of Special Elements in Output Used by\na Downstream Component ('Injection'){{/focus}}{{{nl}}}\nThe software constructs all or part of a command, data structure, or\nrecord using externally-influenced input from an upstream component, but\nit does not neutralize or incorrectly neutralizes special elements that\ncould modify how it is parsed or interpreted when it is sent to a\ndownstream component.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "reflection-injection",
          "shortDescription" : "Reflection Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/470.html",
            "likelihood" : "Medium",
            "references" : "https://owasp.org/Top10/A03_2021-Injection/",
            "owasp" : "https://owasp.org/www-community/vulnerabilities/Unsafe_use_of_Reflection",
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Reflection Injection{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/code$$LINK_DELIM$$Secure\nCode Warrior: Reflection Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_28_CODE_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Reflection Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Injection Flaws - Code\nInjection{{/focus}}{{{nl}}}                 Code injection happens when\nan application insecurely accepts input that is subsequently used in a\ndynamic code evaluation call. If insufficient validation or sanitisation\nis performed on the input, specially crafted inputs may be able to alter\nthe syntax of the evaluated code and thus alter execution. In a worst\ncase scenario, an attacker could run arbitrary code in the server\ncontext and thus perform almost any action on the application server.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Reflection Injection{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/code$$LINK_DELIM$$Secure\nCode Warrior: Reflection Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_28_CODE_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Reflection Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Injection Flaws - Code\nInjection{{/focus}}{{{nl}}}                 Code injection happens when\nan application insecurely accepts input that is subsequently used in a\ndynamic code evaluation call. If insufficient validation or sanitisation\nis performed on the input, specially crafted inputs may be able to alter\nthe syntax of the evaluated code and thus alter execution. In a worst\ncase scenario, an attacker could run arbitrary code in the server\ncontext and thus perform almost any action on the application server.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "x-powered-by-header",
          "shortDescription" : "X-Powered-By Response Header Detected",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/200.html",
            "likelihood" : "Medium",
            "references" : "",
            "owasp" : "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework",
            "custom references" : {
              "text" : "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure\nhttps://owasp.org/www-project-proactive-controls/v3/en/c8-protect-data-everywhere\nhttps://owasp.org/Top10/A02_2021-Cryptographic_Failures/\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure{{{nl}}}https://owasp.org/www-project-proactive-controls/v3/en/c8-protect-data-everywhere{{{nl}}}https://owasp.org/Top10/A02_2021-Cryptographic_Failures/{{{nl}}}"
            },
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}X-Powered-By Response Header Detected{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: X-Powered-By Response Header Detected\nTraining{{/linkExternal}}     {{/listElement}} {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_57_sensitive_data_exposure.mp4$$LINK_DELIM$$Secure\nCode Warrior: X-Powered-By Response Header Detected\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}} {{#focus}}Exposure of\nSensitive Information to an Unauthorized Actor{{/focus}}{{{nl}}}\nThe product exposes sensitive information to an actor that is not\nexplicitly authorized to have access to that information.\n{{/grayedData}}         {{/blockQuote}} {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}X-Powered-By Response Header Detected{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/infoexposure/sensitiveinfo$$LINK_DELIM$$Secure\nCode Warrior: X-Powered-By Response Header Detected\nTraining{{/linkExternal}}     {{/listElement}} {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_57_sensitive_data_exposure.mp4$$LINK_DELIM$$Secure\nCode Warrior: X-Powered-By Response Header Detected\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}} {{#focus}}Exposure of\nSensitive Information to an Unauthorized Actor{{/focus}}{{{nl}}}\nThe product exposes sensitive information to an actor that is not\nexplicitly authorized to have access to that information.\n{{/grayedData}}         {{/blockQuote}} {{!-- end SCW integration block --}}"
            },
            "category" : "Secure Communications"
          }
        }, {
          "id" : "request-validation-disabled",
          "shortDescription" : "Request Validation Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/20.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/hh882339.aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Request Validation Disabled{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Request Validation Disabled{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Request Validation Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "crypto-bad-mac",
          "shortDescription" : "Insecure Hash Algorithms",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/328.html",
            "likelihood" : "Medium",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html",
            "owasp" : "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
            "custom references" : {
              "text" : "https://owasp.org/www-community/vulnerabilities/Using_a_broken_or_risky_cryptographic_algorithm\nhttps://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\nhttps://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/vulnerabilities/Using_a_broken_or_risky_cryptographic_algorithm{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure Hash Algorithms{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/algorithm$$LINK_DELIM$$Secure\nCode Warrior: Insecure Hash Algorithms Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_78_weak_crypto_algorithm.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure Hash Algorithms Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Weak\nHash{{/focus}}{{{nl}}}                 The product uses an algorithm\nthat produces a digest (output value) that does not meet security\nexpectations for a hash function that allows an adversary to reasonably\ndetermine the original input (preimage attack), find another input that\ncan produce the same hash (2nd preimage attack), or find multiple inputs\nthat evaluate to the same hash (birthday attack). {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Insecure Hash Algorithms{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/crypto/algorithm$$LINK_DELIM$$Secure\nCode Warrior: Insecure Hash Algorithms Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_78_weak_crypto_algorithm.mp4$$LINK_DELIM$$Secure\nCode Warrior: Insecure Hash Algorithms Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Use of Weak\nHash{{/focus}}{{{nl}}}                 The product uses an algorithm\nthat produces a digest (output value) that does not meet security\nexpectations for a hash function that allows an adversary to reasonably\ndetermine the original input (preimage attack), find another input that\ncan produce the same hash (2nd preimage attack), or find multiple inputs\nthat evaluate to the same hash (birthday attack). {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Cryptography"
          }
        }, {
          "id" : "verb-tampering",
          "shortDescription" : "Verb Tampering Weakness",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/302.html",
            "likelihood" : "High",
            "references" : "https://wiki.owasp.org/index.php/Testing_for_HTTP_Verb_Tampering_(OTG-INPVAL-003)",
            "owasp" : "https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/03-Testing_for_HTTP_Verb_Tampering",
            "impact" : "Medium",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Verb Tampering Weakness{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Verb Tampering Weakness Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Verb Tampering Weakness Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Verb Tampering Weakness{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Verb Tampering Weakness Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Verb Tampering Weakness Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Security Misconfiguration -\nDisabled Security Features{{/focus}}{{{nl}}}                 This\nvulnerability refers to a mistake or lack of environment identification\ncapabilities that could lead to certain security features being disabled\n(e.g.: access-control). Having such features disabled in a production\nenvironment would leave an application running exclusively on\nsecurity-through-obscurity (simply hiding menu options and such like)\nthat should not be considered of security value.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Access Control"
          }
        }, {
          "id" : "viewstate-encryption-disabled",
          "shortDescription" : "Viewstate Encryption Disabled",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/311.html",
            "likelihood" : "High",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.pagessection.viewstateencryptionmode.aspx",
            "owasp" : "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Viewstate Encryption Disabled{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/ics/insecdatastorage$$LINK_DELIM$$Secure\nCode Warrior: Viewstate Encryption Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_139_plaintext_storage_of_sensitive_data.mp4$$LINK_DELIM$$Secure\nCode Warrior: Viewstate Encryption Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Encryption of\nSensitive Data{{/focus}}{{{nl}}}                 The software does not\nencrypt sensitive or critical information before storage or\ntransmission.             {{/grayedData}}         {{/blockQuote}}  {{!--\nend SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Viewstate Encryption Disabled{{/focus}} vulnerabilities over\non the Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/ics/insecdatastorage$$LINK_DELIM$$Secure\nCode Warrior: Viewstate Encryption Disabled Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_139_plaintext_storage_of_sensitive_data.mp4$$LINK_DELIM$$Secure\nCode Warrior: Viewstate Encryption Disabled Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Missing Encryption of\nSensitive Data{{/focus}}{{{nl}}}                 The software does not\nencrypt sensitive or critical information before storage or\ntransmission.             {{/grayedData}}         {{/blockQuote}}  {{!--\nend SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "cmd-injection",
          "shortDescription" : "OS Command Injection",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/78.html",
            "likelihood" : "Medium",
            "references" : "https://owasp.org/www-community/attacks/Command_Injection",
            "owasp" : "https://owasp.org/Top10/A03_2021-Injection/",
            "custom references" : {
              "text" : "https://wiki.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013)\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://wiki.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013){{{nl}}}"
            },
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}OS Command Injection{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/oscmd$$LINK_DELIM$$Secure\nCode Warrior: OS Command Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/OS+Command+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: OS Command Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nSpecial Elements used in an OS Command ('OS Command\nInjection'){{/focus}}{{{nl}}}                 The software constructs\nall or part of an OS command using externally-influenced input from an\nupstream component, but it does not neutralize or incorrectly\nneutralizes special elements that could modify the intended OS command\nwhen it is sent to a downstream component.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}OS Command Injection{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/oscmd$$LINK_DELIM$$Secure\nCode Warrior: OS Command Injection Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/OS+Command+Injections_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: OS Command Injection Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nSpecial Elements used in an OS Command ('OS Command\nInjection'){{/focus}}{{{nl}}}                 The software constructs\nall or part of an OS command using externally-influenced input from an\nupstream component, but it does not neutralize or incorrectly\nneutralizes special elements that could modify the intended OS command\nwhen it is sent to a downstream component.             {{/grayedData}}\n{{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Injection"
          }
        }, {
          "id" : "session-rewriting",
          "shortDescription" : "Session Rewriting",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https//cwe.mitre.org/data/definitions/384.html",
            "likelihood" : "Medium",
            "references" : "",
            "owasp" : "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/",
            "custom references" : {
              "text" : "https://owasp.org/www-community/attacks/Session_hijacking_attack\nhttps://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html\n",
              "formattedTextVariables" : { },
              "formattedText" : "https://owasp.org/www-community/attacks/Session_hijacking_attack{{{nl}}}https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html{{{nl}}}"
            },
            "impact" : "Medium",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Session Rewriting{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/session/exposedtokens$$LINK_DELIM$$Secure\nCode Warrior: Session Rewriting Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_136_exposed_session_tokens.mp4$$LINK_DELIM$$Secure\nCode Warrior: Session Rewriting Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Session Handling - Exposed Session Tokens{{/focus}}{{{nl}}}\nSession tokens identify an existing session that has already been\nauthenticated and, if disclosed, would allow an attacker to operate the\nsystem as the authenticated user. This can occur when a session token is\nexposed in some insecure way, potentially disclosing it and allowing an\nattacker to use it in a session hijacking attack.\n{{/grayedData}} {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Session Rewriting{{/focus}} vulnerabilities over on the Secure\nCode Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/session/exposedtokens$$LINK_DELIM$$Secure\nCode Warrior: Session Rewriting Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_136_exposed_session_tokens.mp4$$LINK_DELIM$$Secure\nCode Warrior: Session Rewriting Video{{/linkExternal}} {{/listElement}}\n{{/unorderedList}}          {{#blockQuote}} {{#grayedData}}\n{{#focus}}Session Handling - Exposed Session Tokens{{/focus}}{{{nl}}}\nSession tokens identify an existing session that has already been\nauthenticated and, if disclosed, would allow an attacker to operate the\nsystem as the authenticated user. This can occur when a session token is\nexposed in some insecure way, potentially disclosing it and allowing an\nattacker to use it in a session hijacking attack.\n{{/grayedData}} {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Session Management"
          }
        }, {
          "id" : "unsafe-xml-decode",
          "shortDescription" : "Unsafe XML Decoding",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/96.html",
            "likelihood" : "Low",
            "references" : "https://web.archive.org/web/20210122041635/http://diniscruz.blogspot.com/2013/08/using-xmldecoder-to-execute-server-side.html\nhttps://docs.oracle.com/javase/7/docs/api/java/beans/XMLDecoder.html",
            "owasp" : "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unsafe XML Decoding{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/code$$LINK_DELIM$$Secure\nCode Warrior: Unsafe XML Decoding Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_28_CODE_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unsafe XML Decoding Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nDirectives in Statically Saved Code ('Static Code\nInjection'){{/focus}}{{{nl}}}                 The software receives\ninput from an upstream component, but it does not neutralize or\nincorrectly neutralizes code syntax before inserting the input into an\nexecutable resource, such as a library, configuration file, or template.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Unsafe XML Decoding{{/focus}} vulnerabilities over on the\nSecure Code Warrior platform by watching videos and completing training\nexercises and missions that focus on secure coding.{{/paragraph}}\n{{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/injection/code$$LINK_DELIM$$Secure\nCode Warrior: Unsafe XML Decoding Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Module_28_CODE_INJECTION_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Unsafe XML Decoding Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Improper Neutralization of\nDirectives in Statically Saved Code ('Static Code\nInjection'){{/focus}}{{{nl}}}                 The software receives\ninput from an upstream component, but it does not neutralize or\nincorrectly neutralizes code syntax before inserting the input into an\nexecutable resource, such as a library, configuration file, or template.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Input Validation"
          }
        }, {
          "id" : "compilation-debug",
          "shortDescription" : "Web Application Deployed in Debug Mode",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/11.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/s10awwz0(v=vs.100).aspx\nhttps://msdn.microsoft.com/en-us/library/ff400235(v=vs.100).aspx",
            "owasp" : "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/",
            "impact" : "Low",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Web Application Deployed in Debug Mode{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/debug$$LINK_DELIM$$Secure\nCode Warrior: Web Application Deployed in Debug Mode\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_134_debug_features_enabled.mp4$$LINK_DELIM$$Secure\nCode Warrior: Web Application Deployed in Debug Mode\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}ASP.NET Misconfiguration: Creating Debug\nBinary{{/focus}}{{{nl}}}                 Debugging messages help\nattackers learn about the system and plan a form of attack.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Web Application Deployed in Debug Mode{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/debug$$LINK_DELIM$$Secure\nCode Warrior: Web Application Deployed in Debug Mode\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_134_debug_features_enabled.mp4$$LINK_DELIM$$Secure\nCode Warrior: Web Application Deployed in Debug Mode\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}ASP.NET Misconfiguration: Creating Debug\nBinary{{/focus}}{{{nl}}}                 Debugging messages help\nattackers learn about the system and plan a form of attack.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "xcontenttype-header-missing",
          "shortDescription" : "Response Without X-Content-Type-Options Header",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/693.html",
            "likelihood" : "Low",
            "references" : "",
            "owasp" : "https://wiki.owasp.org/index.php/OWASP_Secure_Headers_Project",
            "impact" : "Low",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response Without X-Content-Type-Options Header{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Response Without X-Content-Type-Options Header\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response Without X-Content-Type-Options Header\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Disabled Security\nFeatures{{/focus}}{{{nl}}}                 This vulnerability refers to\na mistake or lack of environment identification capabilities that could\nlead to certain security features being disabled (e.g.: access-control).\nHaving such features disabled in a production environment would leave an\napplication running exclusively on security-through-obscurity (simply\nhiding menu options and such like) that should not be considered of\nsecurity value.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Response Without X-Content-Type-Options Header{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/misconfig/securityfeatures$$LINK_DELIM$$Secure\nCode Warrior: Response Without X-Content-Type-Options Header\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/module_132_disabled_security_features.mp4$$LINK_DELIM$$Secure\nCode Warrior: Response Without X-Content-Type-Options Header\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}Security Misconfiguration - Disabled Security\nFeatures{{/focus}}{{{nl}}}                 This vulnerability refers to\na mistake or lack of environment identification capabilities that could\nlead to certain security features being disabled (e.g.: access-control).\nHaving such features disabled in a production environment would leave an\napplication running exclusively on security-through-obscurity (simply\nhiding menu options and such like) that should not be considered of\nsecurity value.             {{/grayedData}}         {{/blockQuote}}\n{{!-- end SCW integration block --}}"
            },
            "category" : "Configuration"
          }
        }, {
          "id" : "csrf",
          "shortDescription" : "Cross-Site Request Forgery",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/352.html",
            "likelihood" : "Medium",
            "references" : "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html\nhttps://en.wikipedia.org/wiki/Cross-site_request_forgery\nhttps://threatpost.com/exploit-kit-using-csrf-to-redirect-soho-router-dns-settings/112993/",
            "owasp" : "https://owasp.org/www-community/attacks/csrf",
            "impact" : "High",
            "confidence level" : 1,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cross-Site Request Forgery{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/csrf/csrf$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Request Forgery Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Cross+Site+Request+Forgery_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Request Forgery Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cross-Site Request Forgery\n(CSRF){{/focus}}{{{nl}}}                 The web application does not,\nor can not, sufficiently verify whether a well-formed, valid, consistent\nrequest was intentionally provided by the user who submitted the\nrequest.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Cross-Site Request Forgery{{/focus}} vulnerabilities over on\nthe Secure Code Warrior platform by watching videos and completing\ntraining exercises and missions that focus on secure\ncoding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/csrf/csrf$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Request Forgery Training{{/linkExternal}}\n{{/listElement}}               {{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Cross+Site+Request+Forgery_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Cross-Site Request Forgery Video{{/linkExternal}}\n{{/listElement}}  {{/unorderedList}}          {{#blockQuote}}\n{{#grayedData}}                 {{#focus}}Cross-Site Request Forgery\n(CSRF){{/focus}}{{{nl}}}                 The web application does not,\nor can not, sufficiently verify whether a well-formed, valid, consistent\nrequest was intentionally provided by the user who submitted the\nrequest.             {{/grayedData}}         {{/blockQuote}}  {{!-- end\nSCW integration block --}}"
            },
            "category" : "Authentication"
          }
        }, {
          "id" : "forms-auth-redirect",
          "shortDescription" : "Forms Authentication Cross-App Redirect",
          "helpUri" : "https://www.contrastsecurity.com",
          "properties" : {
            "cwe" : "https://cwe.mitre.org/data/definitions/601.html",
            "likelihood" : "Low",
            "references" : "https://msdn.microsoft.com/en-us/library/system.web.configuration.formsauthenticationconfiguration.enablecrossappredirects.aspx",
            "owasp" : "https://owasp.org/Top10/A01_2021-Broken_Access_Control/",
            "impact" : "High",
            "confidence level" : 3,
            "custom recommendation" : {
              "text" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Authentication Cross-App Redirect{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication Cross-App Redirect\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication Cross-App Redirect\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}URL Redirection to Untrusted Site ('Open\nRedirect'){{/focus}}{{{nl}}}                 A web application accepts a\nuser-controlled input that specifies a link to an external site, and\nuses that link in a Redirect. This simplifies phishing attacks.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}",
              "formattedTextVariables" : { },
              "formattedText" : "{{!-- begin SCW integration block --}} {{#header}}Secure Code Warrior\n{{#omitted}} Beta{{/omitted}}{{/header}} {{#paragraph}}Learn more about\n{{#focus}}Forms Authentication Cross-App Redirect{{/focus}}\nvulnerabilities over on the Secure Code Warrior platform by watching\nvideos and completing training exercises and missions that focus on\nsecure coding.{{/paragraph}}  {{#unorderedList}}     {{#listElement}}\n{{#linkExternal}}https://portal.securecodewarrior.com/?utm_source=partner-integration:contrast#/contextual-microlearning/web/uraf/generic$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication Cross-App Redirect\nTraining{{/linkExternal}}     {{/listElement}}\n{{#listElement}}\n{{#linkExternal}}https://media.securecodewarrior.com/v2/Unvalidated_Redirects_and_Forwards_v2.mp4$$LINK_DELIM$$Secure\nCode Warrior: Forms Authentication Cross-App Redirect\nVideo{{/linkExternal}}             {{/listElement}}  {{/unorderedList}}\n{{#blockQuote}}             {{#grayedData}}\n{{#focus}}URL Redirection to Untrusted Site ('Open\nRedirect'){{/focus}}{{{nl}}}                 A web application accepts a\nuser-controlled input that specifies a link to an external site, and\nuses that link in a Redirect. This simplifies phishing attacks.\n{{/grayedData}}         {{/blockQuote}}  {{!-- end SCW integration block --}}"
            },
            "category" : "Authentication"
          }
        } ]
      }
    },
    "results" : [ {
      "ruleId" : "cmd-injection",
      "message" : {
        "text" : "OS Command Injection from \"lastName\" Parameter on \"/owners\" page"
      },
      "locations" : [ {
        "physicalLocation" : {
          "artifactLocation" : {
            "uri" : "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
          },
          "region" : {
            "startLine" : 25
          }
        }
      } ],
      "properties" : {
        "severity" : "HIGH",
        "substatus" : "",
        "uuid" : "GKI8-6KDN-YPWL-ISK6",
        "status" : "AutoRemediated"
      }
    }, {
      "ruleId" : "csrf",
      "message" : {
        "text" : "Cross-Site Request Forgery detected"
      },
      "locations" : [ {
        "physicalLocation" : {
          "artifactLocation" : {
            "uri" : "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
          },
          "region" : {
            "startLine" : 1
          }
        }
      } ],
      "properties" : {
        "severity" : "HIGH",
        "substatus" : "",
        "uuid" : "8WFS-K3A4-ZXT2-6U1C",
        "status" : "AutoRemediated"
      }
    }, {
      "ruleId" : "hql-injection",
      "level" : "error",
      "message" : {
        "text" : "Hibernate Injection from \"lastName\" Parameter on \"/owners\" page"
      },
      "locations" : [ {
        "physicalLocation" : {
          "artifactLocation" : {
            "uri" : "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
          },
          "region" : {
            "startLine" : 28
          }
        }
      } ],
      "stacks": [ {
        "message" : {
          "text" : "User input is received from HTTP request -stack"
        },
        "frames": [ {
          "location": {
            "physicalLocation": {
              "artifactLocation": {
                "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
              }, 
              "region": {
                "startLine": 28
              }
            }
          }
        }, { 
          "location": {
            "physicalLocation": {
              "artifactLocation": {
                "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
              }, 
              "region": {
                "startLine": 28
              }
            }
          }
        }, { 
          "location": {
            "physicalLocation": {
              "artifactLocation": {
                "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
              }, 
              "region": {
                "startLine": 28
              }
            }
          }
        } ]
      } ],


      "codeFlows": [ {
        "threadFlows": [ {
          "locations": [ {
            "location": {
              "message": {
                "text": "User input is received from HTTP request."
              },
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
                },
                "region": {
                  "startLine": 22
                }
              }              
            },
            "stack": {
              "frames": [ {
                "location": {
                  "physicalLocation": {
                    "artifactLocation": {
                      "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
                    },
                    "region": {
                      "startLine": 22
                    }
                  }
                }
              } ]
            }
          },
          {
            "location": {
              "message": {
                "text": "Intermediate bad thing happens."
              },
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
                },
                "region": {
                  "startLine": 25
                }
              }              
            },
            "stack": {
              "frames": [ {
                "location": {
                  "physicalLocation": {
                    "artifactLocation": {
                      "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
                    },
                    "region": {
                      "startLine": 25
                    }
                  }
                }
              } ]
            }
          },
          {
            "location": {
              "message": {
                "text": "Bad thing happens."
              },
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
                },
                "region": {
                  "startLine": 28
                }
              }              
            },
            "stack": {
              "frames": [ {
                "location": {
                  "physicalLocation": {
                    "artifactLocation": {
                      "uri": "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
                    },
                    "region": {
                      "startLine": 28
                    }
                  }
                }
              } ]
            }
          } ]
        } ]
      } ],

      "properties" : {
        "severity" : "CRITICAL",
        "substatus" : "",
        "uuid" : "3UTV-P65G-VSIX-P5GX",
        "status" : "AutoRemediated"
      }
    }, {
      "ruleId" : "stored-xss",
      "message" : {
        "text" : "Stored Cross-Site Scripting from Tainted Database Value on \"/owners/{n}\" page"
      },
      "locations" : [ {
        "physicalLocation" : {
          "artifactLocation" : {
            "uri" : "src/main/java/org/springframework/samples/petclinic/owner/OwnerRepositoryCustomImpl.java"
          },
          "region" : {
            "startLine" : 1
          }
        }
      } ],
      "properties" : {
        "severity" : "HIGH",
        "substatus" : "",
        "uuid" : "G6QG-GADG-4CA5-XPLI",
        "status" : "AutoRemediated"
      }
    } ]
  } ]
}