0

My VM scanner has detected the following vulnerabilities through an authenticated scan, see below.

This is from a web app provided by BIGSQL (Dev & Ops Web App). Is it safe to use this app or would it be possible to exploit those vulnerabilities without having credentials? If someone manages to gain unauthorized access to the web app then I would imagine that those vulnerabilities would be the least of my concern.

enter image description here

closed as too broad by Matthew, crovers, schroeder Nov 1 '17 at 13:58

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • crosspost – bummi Nov 1 '17 at 13:47
  • 1
    No way to tell from the information provided. If you want to know about unauthenticated access to vulnerabilities, run an unauthenticated scan... Although there could be problems with the boundaries between the two - if an unauthenticated user can plant a payload which an authenticated user triggers, they might be able to escalate their privileges. – Matthew Nov 1 '17 at 13:52
  • You'd need to evaluate all of these results - ok, it says it has XSS - does it really (false positives are possible), what is the potential impact, who is the userbase, what is the data contained. This is where tools stop and actual humans start - but we can't do that here. Voting to close. – crovers Nov 1 '17 at 13:53
2

Any results from an automated scan should be followed up with manual testing to confirm or deny a result.

Also, without knowledge of exactly what your application does it hard to determine the impact some of these vulnerabilities would have but generally I would not allow an app into production with some the the problems detected in the scan such as XSS, CSRF and Cookie flags.

You have to determine what your application does, the data it uses and actions that can be performed through it and then understand the vulnerabilities and how those can impact your users and data.

I would not dismiss a vulnerability just because it was found with an authenticated scan, especially if anyone can register/sign up through the application. You definitely want to have multiple layers of defense.

I recommend do some manually testing to confirm these and if they are confirmed put measures in place for XSS, CSRF, cookie flags, click jacking but again you have to determine your own risks based on your application

Not the answer you're looking for? Browse other questions tagged or ask your own question.