DerScanner
Home / Vulnerability Database / TypeScript : Cookie: broad path
TypeScript

TypeScript : Cookie: broad path

Classification

OWASP Top 10 2013
A2-Broken Authentication and Session Management
OWASP Mobile Top 10 2016
M2-Insecure Data Storage
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
OWASP ASVS
Session Management
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (e)(1)
CWE
CWE-1028

Overview

Cookie path is set broadly. Broad path (for example, /) is insecure, because in this case the vulnerability in one application may endanger other applications in the same domain.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP: Top 10 2017 A2-Broken Authentication
  2. OWASP: Top 10 2013-A2-Broken Authentication and Session Management
  3. OWASP: Top 10 2013-A5-Security Misconfiguration
  4. Origin Cookies: Session Integrity for Web Applications (pdf)
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
MEDIUM

DerScanner Severity Score

Do you want to fix TypeScript : Cookie: broad path in your application?

See also

TypeScript

TypeScript : Unsafe Azure access control

TypeScript

TypeScript : Debug code

TypeScript

TypeScript : XSS protection is disabled