Account Takeover
Description
By exploiting one or several application vulnerabilities it is possible to take control over a user account and perform action on his behalf
Impact
- Affect the traceability and non-repudiation of the user's actions. - Deny the access of a legitimate user to its own account - Obtain potentially confidential information from the user account
Recommendation
Define account recovery mechanisms, validating that the requester is the account owner.
Threat
Authenticated attacker from the Internet
Expected Remediation Time
⏱️ 100 minutes.