Lack of data validation - OTP
Description
There is no evidence of validation of the values sent in the tokenCode parameter to complete the request, allowing random values to be used in multiple attempts.
Impact
Perform the account creation process without knowing the generated token.
Recommendation
- Validate on the server side that the token sent by the user is the one generated for the request. - Validate that the token generated is used only once.
Threat
External attacker authenticated.
Expected Remediation Time
⏱️ 90 minutes.
Score
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
Attack vector
N
Attack complexity
L
Attack requirements
N
Privileges required
L
User interaction
N
Confidentiality (VC)
N
Integrity (VI)
L
Availability (VA)
N
Confidentiality (SC)
N
Integrity (SI)
N
Availability (SA)
N
Threat 4.0
Exploit maturity
X
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N