mgonzalezcx / WebGoat

WebGoat is a deliberately insecure application
https://webgoat.github.io/WebGoat/
Other
0 stars 0 forks source link

CX Spring_Missing_Function_Level_Authorization @ webgoat-lessons/webgoat-lesson-template/src/main/java/org/owasp/webgoat/template/SampleAttack.java [develop] #4

Open mgonzalezcx opened 2 years ago

mgonzalezcx commented 2 years ago

Spring_Missing_Function_Level_Authorization issue exists @ webgoat-lessons/webgoat-lesson-template/src/main/java/org/owasp/webgoat/template/SampleAttack.java in branch develop

Line 56 flags a method or annotation that could be a potential unauthorized access to object available in the corresponding controller. This query is looking for possible flaws in Spring-Security configuration, so only projects that use Spring-Security are considered.

Severity: Information

CWE:862

Vulnerability details and guidance

Checkmarx

Training Recommended Fix

Lines: 54


Code (Line #54):

    @PostMapping("/lesson-template/sample-attack")