Description

The credentials policy present in the system warns that these cannot be consecutive and/or repeated numbers, however this validation is only done in the front end of the application, so it is possible to modify the password from the same request and assign a key that goes against the policies.

Impact

Bypass security policies assigned for user keys.

Recommendation

The key creation policy must be validated on both the front and back ends of the application.

Threat

Attacker without credentials from the Internet.

Expected Remediation Time

⏱️ 60 minutes.

Requirements

Fixes