software composition analysis
Product
SAST
Catch vulnerabilities as you develop DAST
Test live web applications like an attacker SCA
Secure open-source and supply chain MAST
Secure mobile apps from code to store Compliance
Align with standards while shipping secure code
Resources
Vulnerability database Healthy Package
Blog News
Documentation
Pricing Partners About Us Log In
software composition analysis

Delphi : Cookie: broad domain

Classification

OWASP Top 10 2013 A2-Broken Authentication and Session Management OWASP Mobile Top 10 2016 M2-Insecure Data Storage OWASP Top 10 2017 A2-Broken Authentication A3-Sensitive Data Exposure OWASP Top 10 2021 A2-Cryptographic Failures A4-Insecure Design A7-Identification and Authentication Failures PCI DSS 4.0 6.2.4 HIPAA §164.312 (e)(1) CWE CWE-1028

Overview

Cookie domain is set broadly. Broad domain (e.g., .example.com) is insecure, because in this case the vulnerability in one application could endanger other applications in the same domain.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2013-A5-Security Misconfiguration
  2. Origin Cookies: Session Integrity for Web Applications (pdf)
  3. OWASP Top 10 2017 A2-Broken Authentication
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication

See also

Delphi : Cookie: broad path
Delphi : HMAC using weak hashing algorithm
Delphi : Weak encryption algorithm