102 – Email uniqueness not properly verified
Description
The system allows the plus character in the email registration process. An attacker could abuse this feature to create several accounts pointing to the same email.
Impact
Create multiple accounts with the same email.
Recommendation
The system must validate emails in such way that an inbox only can be associated or represent an account.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): L
- Availability (SA): N
Threat 4.0
- Exploit maturity: P