1. Broken Access Control

Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user’s limits. Common access control vulnerabilities include: 

• Violation of the principle of least privilege or deny by default, where access should only be granted for particular capabilities, roles, or users, but is available to anyone. 
• Bypassing access control checks by modifying the URL (parameter tampering or force browsing), internal application state, or the HTML page, or by using an attack tool modifying API requests. 
• Permitting viewing or editing someone else’s account, by providing its unique identifier (insecure direct object references). 
• Accessing API with missing access controls for POST, PUT and DELETE. 
• Elevation of privilege. Acting as a user without being logged in or acting as an admin when logged in as a user. 
• Metadata manipulation, such as replaying or tampering with a JSON Web Token (JWT) access control token, or a cookie or hidden field manipulated to elevate privileges or abusing JWT invalidation. 
• CORS misconfiguration allows API access from unauthorized/untrusted origins. 
• Force browsing to authenticated pages as an unauthenticated user or to privileged pages as a standard user.

Yes

Yes

Yes

No

No

3. Injection

An application is vulnerable to attack when user-supplied data is not validated, filtered, or sanitized by the application. 

• Dynamic queries or non-parameterized calls without context-aware escaping are used directly in the interpreter. 
• Hostile data is used within object-relational mapping (ORM) search parameters to extract additional, sensitive records. 
• Hostile data is directly used or concatenated. The SQL or command contains the structure and malicious data in dynamic queries, commands, or stored procedures. 

Some of the more common injections are SQL, NoSQL, OS command, Object Relational Mapping (ORM), LDAP, and Expression Language (EL) or Object Graph Navigation Library (OGNL) injection.

Yes

Yes

Yes

Yes

No

5. Security Misconfiguration

The application might be vulnerable if the application is: 

• Missing appropriate security hardening across any part of the application stack or improperly configured permissions on cloud services. 
• Unnecessary features are enabled or installed (e.g., unnecessary ports, services, pages, accounts, or privileges). 
• Default accounts and their passwords are still enabled and unchanged. 
• Error handling reveals stack traces or other overly informative error messages to users. 
• For upgraded systems, the latest security features are disabled or not configured securely. 
• The security settings in the application servers, application frameworks (e.g., Struts, Spring, ASP.NET), libraries, databases, etc., are not set to secure values. 
• The server does not send security headers or directives, or they are not set to secure values. 
• The software is out of date or vulnerable. 

Without a concerted, repeatable application security configuration process, systems are at a higher risk.

Yes

Yes

Yes

No

No

7. Identification & Authentication Failures

Confirmation of the user’s identity, authentication, and session management is critical to protect against authentication-related attacks. There may be authentication weaknesses if the application: 

• Permits automated attacks such as credential stuffing, where the attacker has a list of valid usernames and passwords. 
• Permits brute force or other automated attacks. 
• Permits default, weak, or well-known passwords, such as “Password1” or “admin/admin”. 
• Uses weak or ineffective credential recovery and forgot-password processes, such as “knowledge-based answers,” which cannot be made safe. 
• Uses plain text, encrypted, or weakly hashed passwords data stores. 
• Has missing or ineffective multi-factor authentication. 
• Exposes session identifier in the URL. 
• Reuse session identifier after successful login. 
• Does not correctly invalidate Session IDs. User sessions or authentication tokens (mainly single sign-on (SSO) tokens) aren’t properly invalidated during logout or a period of inactivity.

Yes

Yes

Yes

No

No

9. Security Logging and Monitoring Failures

This category is to help detect, escalate, and respond to active breaches. Without logging and monitoring, breaches cannot be detected. Insufficient logging, detection, monitoring, and active response occurs any time: 

• Auditable events, such as logins, failed logins, and high-value transactions, are not logged. 
• Warnings and errors generate no, inadequate, or unclear log messages. 
• Logs of applications and APIs are not monitored for suspicious activity. 
• Logs are only stored locally. 
• Appropriate alerting thresholds and response escalation processes are not in place or effective. 
• Penetration testing and scans by dynamic application security testing (DAST) tools (such as OWASP ZAP) do not trigger alerts. 
• The application cannot detect, escalate, or alert for active attacks in real-time or near real-time. 

You are vulnerable to information leakage by making logging and alerting events visible to a user or an attacker.

No

No

Yes

No

No