199 – Lack of data validation - Emails
Description
The application does not control that server-side emails used to register users do not belong to disposable mailboxes such as yopmail.
Impact
Reset passwords for registered users with disposable mailboxes.
Recommendation
Implement a blacklisting system with disposable mailbox domains or implement federated authentication.
Threat
Anonymous attacker from the Internet using enumerated users.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: H
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): L
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X