245 – Non-encrypted confidential information - Credit Cards
Description
In alignment with the PCI DSS standard, sensitive information regarding payment cards must be masked and encrypted at the user end and at the server end.
Impact
Obtain credit card information.
Recommendation
Encrypt all sensitive information that is transported or stored within the application according to the organizations policies.
Threat
Unauthorized insider attacker performing a MitM.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: A
- Attack complexity: H
- Attack Requirements: N
- Privileges required: N
- User interaction: P
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X