DerScanner
Home / Vulnerability Database / JavaScript : Easily guessed database name
JavaScript

JavaScript : Easily guessed database name

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic Failures
CWE
CWE-1032

Overview

Database name is easy to guess. This may lead to data confidentiality violation.

One of the features of HTML5 is the storage data in a client-side SQL database. The main piece of information required for writing to and reading from the database is its name. Therefore, it is important that the name of the database is a unique string that differs from user to user. If the name of the database is easy to guess, unauthorized parties, such as other users, might be able to steal sensitive data or corrupt the database entries.

References

  1. OWASP: Database security
  2. Guide to Secure Implementation of HTML5’s Web SQL Database
  3. OWASP Top 10 2017-A3-Sensitive Data Exposure
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
LOW

DerScanner Severity Score

Do you want to fix JavaScript : Easily guessed database name in your application?

See also

JavaScript

JavaScript : Null salt

JavaScript

JavaScript : Empty encryption key

JavaScript

JavaScript : Unsafe Azure access control