Description

The system logs entries that contain input from untrusted sources without properly validating, sanitizing or escaping their content.

Impact

Inject code or fake inputs in the systems log, compromising the integrity of logs, or in the worst case, the system of who is viewing the logs.

Recommendation

Sanitize inputs before storing them in the log.

Threat

Authenticated attacker from the Internet.

Expected Remediation Time

⏱️ 30 minutes.

Requirements

Fixes