039 – Improper authorization control for web services
Description
The systems web services do not have an authorization control mechanism or the one in place can be bypassed.
Impact
Obtain confidential information from users.
Recommendation
Validate through session cookies or tokens that users trying to access certain information are authenticated.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X