DerScanner
Home / Vulnerability Database / Scala : Sensitive data in redirect parameters
Scala

Scala : Sensitive data in redirect parameters

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
OWASP MASVS
V2: 2.4.(L1/L2/L1+R/L2+R)
PCI DSS 4.0
6.2.48.3.2
HIPAA
§164.312 (e)(1)
CWE
CWE-1032

Overview

The application sends the password as a part of HTTP redirect. This way of valuable data transfer may lead to its confidentiality loss.

As a result of HTTP redirect the user’s browser generates a GET request. GET request parameters are not considered confidential, so the password transferred via redirection may be displayed on the screen, recorded in the log, and stored in the browser or proxy server cache.

References

  1. OWASP Top 10 2017-A2-Broken Authentication
  2. OWASP Top 10 2017-A3-Sensitive Data Exposure
  3. CWE-359: Exposure of Private Information (‘Privacy Violation’)
  4. OWASP Top 10 2013-A6-Sensitive Data Exposure
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MEDIUM

DerScanner Severity Score

Do you want to fix Scala : Sensitive data in redirect parameters in your application?

See also

Scala

Scala : Unreleased resource stream

Scala

Scala : Multiple loggers in same class

Scala

Scala : Insufficient encryption key length