|
|
@@ -67,7 +67,7 @@ Scope is the web application (back office) and the APIs.
|
|
|
* Remote code execution (RCE)
|
|
|
* Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
|
|
|
* Code injections (HTML, JS, SQL, PHP, ...)
|
|
|
-* Cross-Site Scripting (XSS), except from setup page of module "External web site" (allowing any content here, editable by admin user only, is accepted on purpose or into module "Web site" when permission to edit website content is allowed).
|
|
|
+* Cross-Site Scripting (XSS), except from setup page of module "External web site" (allowing any content here, editable by admin user only, is accepted on purpose) and except into module "Web site" when permission to edit website content is allowed (injecting any data in this case is allowed too).
|
|
|
* Cross-Site Requests Forgery (CSRF) with real security impact (when using GET URLs, CSRF are qualified only for creating, updating or deleting data from pages restricted to admin users)
|
|
|
* Open redirect
|
|
|
* Broken authentication & session management
|
Laurent Destailleur