298 – Authentication mechanism absence or evasion - Redirect
Description
An attacker can gain access to the application by knowing a valid username by changing the redirect with which the server responds.
Impact
- Bypass the authentication process by changing the page redirection and thus gain access to the applications functionality. - Know a valid user. - Change the redirect and access the application.
Recommendation
Put in place for every resource with business-critical functionality a strong authentication process and ensure that every user attempting to access it is logged in.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: A
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): H
- Integrity (VI): H
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X