search

Custodela / NodeGoat

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project
Apache License 2.0
0 stars 0 forks source link

CX Security_Misconfiguration @ app/routes/session.js [master] #7

Open kmcdon83 opened 6 years ago

kmcdon83 commented 6 years ago

Security_Misconfiguration issue exists @ app/routes/session.js in branch master

The application takes sensitive, personal data password, found at line 189 of app\routes\session.js, and stores it in an unprotected manner, without encryption, to anony140326909var at line 117 of app\data\user-dao.js. 

Severity: High CWE:933 Vulnerability details and guidance Internal Guidance Lines: 195

Code (Line #195):

        var password = req.body.password;
kmcdon83 commented 6 years ago

Issue still exists.

kmcdon83 commented 6 years ago

Issue still exists.