194 – Lack of data validation - Input Length
Description
Endpoints allow more content to be added to the body than is usually allowed by the endpoint, thus making it possible to send massive amounts of characters and expand attack vectors.
Impact
Send massive information in the request body.
Recommendation
Validate on the server side that user entries comply with a character limit.
Threat
Authorized attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): N
- Integrity (VI): N
- Availability (VA): L
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X