CWE-205 on ZAP

Access Control Issue - Improper Authorization

Mon, 01 Jan 0001 00:00:00 +0000

Insufficient Authorization results when an application does not perform adequate authorization checks to ensure that the user is performing a function or accessing data in a manner consistent with the security policy. Authorization procedures should enforce what a user, service or application is permitted to do. When a user is authenticated to a web site, it does not necessarily mean that the user should have full access to all content and functionality.

Cookie Slack Detector

Mon, 01 Jan 0001 00:00:00 +0000

Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.

GraphQL Server Implementation Identified

Mon, 01 Jan 0001 00:00:00 +0000

The server is using “Example GraphQL Engine”, which is a GraphQL implementation for “Example Technology 1” and “Example Technology 2”.