OWASP TOP 10 2017

Compliance Report

2025-07-23

Generated by Acunetix

1
Description

The primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about
the consequences of the most important web application security weaknesses. The Top 10 provides basic techniques to
protect against these high risk problem areas - and also provides guidance on where to go from here.

Disclaimer

This document or any of its content cannot account for, or be included in any form of legal advice. The outcome of a
vulnerability scan (or security evaluation) should be utilized to ensure that diligent measures are taken to lower the risk of
potential exploits carried out to compromise data.

Legal advice must be supplied according to its legal context. All laws and the environments in which they are applied, are
constantly changed and revised. Therefore no information provided in this document may ever be used as an alternative to
a qualified legal body or representative.

A portion of this report is taken from OWASP's Top Ten 2017 Project document, that can be found at http://www.owasp.org.

Scan
URL sisacademico.umsa.edu.bo
Scan date 2025-07-21T00:28:51.641339-04:00
Duration 1 minutes, 21 seconds
Profile Full Scan

Compliance at a Glance

This section of the report is a summary and lists the number of alerts found according to individual compliance categories.

- Injection(A1)
Total number of alerts in this category: 2

- Broken Authentication(A2)
Total number of alerts in this category: 1

- Sensitive Data Exposure(A3)

Total number of alerts in this category: 8

- XML External Entity (XXE)(A4)

No alerts in this category

- Broken Access Control(A5)

Total number of alerts in this category: 1

- Security Misconfiguration(A6)
Total number of alerts in this category: 6

- Cross Site Scripting (XSS)(A7)

No alerts in this category

- Insecure Deserialization(A8)
No alerts in this category

- Using Components with Known Vulnerabilities(A9)

Total number of alerts in this category: 4

- Insufficient Logging and Monitoring(A10)

No alerts in this category

2
Compliance According to Categories: A Detailed Report

This section is a detailed report that explains each vulnerability found according to individual compliance categories.

(A1)Injection

Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent an interpreter as part of a
command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing
data without proper authorization.

Total number of alerts in this category: 2

Alerts in this category

SQL injection

SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a
web application's database server.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Base Score: 10.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
Base Score: 6.8
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: Partial
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-89
Affected item /mi/login/login1.do
Affected parameter clave
Variants 1␀À§À¢%2527%2522

SQL injection

SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a
web application's database server.

3
 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Base Score: 10.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
Base Score: 6.8
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: Partial
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-89
Affected item /mi/login/login1.do
Affected parameter id_usuario
Variants 1␀À§À¢%2527%2522

(A2)Broken Authentication

Application functions related to authentication and session management are often implemented incorrectly, allowing
attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other
users' identities.

Total number of alerts in this category: 1

Alerts in this category

Unencrypted connection (verified)

This scan target was connected to over an unencrypted connection. A potential attacker can intercept and modify data sent
and received from this site.

4
 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score: 9.1
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
Base Score: 5.8
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-310
Affected item Web Server
Affected parameter

(A3)Sensitive Data Exposure

Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare and PII. Attackers
may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data
may be compromised without extra protection, such as encryption at rest or in transit, and requires pecial precautions when
exchanged with the browser.

Total number of alerts in this category: 8

Alerts in this category

Apache JServ protocol service

The Apache JServ Protocol (AJP) is a binary protocol that can proxy inbound requests from a web server through to an
application server that sits behind the web server. It's not recommended to have AJP services publicly accessible on the
internet. If AJP is misconfigured it could allow an attacker to access to internal resources.

5
 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

Application error messages

This alert requires manual confirmation

Acunetix found one or more error/warning messages. Application error or warning messages may expose sensitive
information about an application's internal workings to an attacker.
These messages may also contain the location of the file that produced an unhandled exception.
Consult the 'Attack details' section for more information about the affected page(s).

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 5.3
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None

6
 Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-200
Affected item Web Server
Affected parameter

Directory listings (verified)

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website
directory. It is dangerous to leave this function turned on for the web server because it leads to information disclosure.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 5.3
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None
Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-538
Affected item Web Server
Affected parameter

Multiple vulnerabilities fixed in PHP versions 5.5.12 and 5.4.28

7
List of vulnerabilities that were fixed in PHP versions 5.5.12 and 5.4.28:

Core:

Fixed bug #61019 (Out of memory on command stream_get_contents).

Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
Fixed bug #66182 (exit in stream filter produces segfault).
Fixed bug #66736 (fpassthru broken).
Fixed bug #67024 (getimagesize should recognize BMP files with negative height).
Fixed bug #67043 (substr_compare broke by previous change).

cURL:

Fixed bug #66562 (curl_exec returns differently than curl_multi_getcontent).

Date:

Fixed bug #66721 (__wakeup of DateTime segfaults when invalid object data is supplied).

Embed:

Fixed bug #65715 (php5embed.lib isn't provided anymore).

Fileinfo:

Fixed bug #66987 (Memory corruption in fileinfo ext / bigendian).

FPM:

Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf).

Fixed bug #67060 (possible privilege escalation due to insecure default configuration). (CVE-2014-0185)).

Json:

Fixed bug #66021 (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).

LDAP:

Fixed issue with null bytes in LDAP bindings.

mysqli:

Fixed problem in mysqli_commit()/mysqli_rollback() with second parameter (extra comma) and third parameters (lack
of escaping).

Openssl:

Fixed bug #66942 (memory leak in openssl_seal()).

Fixed bug #66952 (memory leak in openssl_open()).

SimpleXML:

Fixed bug #66084 (simplexml_load_string() mangles empty node name).

SQLite:

Fixed bug #66967 (Updated bundled libsqlite to 3.8.4.3)

XSL:

Fixed bug #53965 (<xsl:include> cannot find files with relative paths when loaded with "file://")

Apache2 Handler SAPI:

8
 Fixed Apache log issue caused by APR's lack of support for %zu (APR issue
https://issues.apache.org/bugzilla/show_bug.cgi?id=56120)

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score: 5.6
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CVE CVE-2014-0185
CWE CWE-16
Affected item Web Server
Affected parameter

Source code disclosures

One or more pages disclosing source code were found. This check is using pattern matching to determine if server side
tags are found in the file. In some cases this alert may generate false positives.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None

9
 Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-538
Affected item Web Server
Affected parameter

Clickjacking: X-Frame-Options header missing

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user
into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential
information or taking control of their computer while clicking on seemingly innocuous web pages.

The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking
attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed
to render a page inside a frame or iframe. Sites can use this to avoid clickjacking attacks, by ensuring that their content is
not embedded into other sites.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score: 5.8
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: Low
Availability Impact: None
Base Score: 4.3
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: None
Integrity Impact: Partial
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-693

10
 Affected item Web Server
Affected parameter

Content Security Policy (CSP) not implemented

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks,
including Cross Site Scripting (XSS) and data injection attacks.

Content Security Policy (CSP) can be implemented by adding a Content-Security-Policy header. The value of this header
is a string containing the policy directives describing your Content Security Policy. To implement CSP, you should define
lists of allowed origins for the all of the types of resources that your site utilizes. For example, if you have a simple site that
needs to load scripts, stylesheets, and images hosted locally, as well as from the jQuery library from their CDN, the CSP
header could look like the following:

Content-Security-Policy:

default-src 'self';

script-src 'self' https://code.jquery.com;

It was detected that your web application doesn't implement Content Security Policy (CSP) as the CSP header is missing
from the response. It's recommended to implement Content Security Policy (CSP) into your web application.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: Required
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

11
Password type input with auto-complete enabled

When a new name and password is entered in a form and the form is submitted, the browser asks if the password should
be saved.Thereafter when the form is displayed, the name and password are filled in automatically or are completed as the
name is entered. An attacker with local access could obtain the cleartext password from the browser cache.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-200
Affected item Web Server
Affected parameter

(A4)XML External Entity (XXE)

Many older or poorly configured XML processors evaluate external entity references within XML documents. External
entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote
code execution, and denial of service attacks.

No alerts in this category.

(A5)Broken Access Control

Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these
flaws to access unauthorized functionality and/or data, such as access other users' accounts, view sensitive files, modify
other users' data, change access rights, etc.

Total number of alerts in this category: 1

Alerts in this category

12
Clickjacking: X-Frame-Options header missing

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user
into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential
information or taking control of their computer while clicking on seemingly innocuous web pages.

The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking
attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed
to render a page inside a frame or iframe. Sites can use this to avoid clickjacking attacks, by ensuring that their content is
not embedded into other sites.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score: 5.8
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: Low
Availability Impact: None
Base Score: 4.3
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: None
Integrity Impact: Partial
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-693
Affected item Web Server
Affected parameter

(A6)Security Misconfiguration

Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations,
incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages
containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securly
configured, but they must be patched and upgraded in a timely fashion.

Total number of alerts in this category: 6

Alerts in this category

Apache JServ protocol service

13
The Apache JServ Protocol (AJP) is a binary protocol that can proxy inbound requests from a web server through to an
application server that sits behind the web server. It's not recommended to have AJP services publicly accessible on the
internet. If AJP is misconfigured it could allow an attacker to access to internal resources.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

Directory listings (verified)

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website
directory. It is dangerous to leave this function turned on for the web server because it leads to information disclosure.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 5.3
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None

14
 Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-538
Affected item Web Server
Affected parameter

Multiple vulnerabilities fixed in PHP versions 5.5.12 and 5.4.28

List of vulnerabilities that were fixed in PHP versions 5.5.12 and 5.4.28:

Core:

Fixed bug #61019 (Out of memory on command stream_get_contents).

Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
Fixed bug #66182 (exit in stream filter produces segfault).
Fixed bug #66736 (fpassthru broken).
Fixed bug #67024 (getimagesize should recognize BMP files with negative height).
Fixed bug #67043 (substr_compare broke by previous change).

cURL:

Fixed bug #66562 (curl_exec returns differently than curl_multi_getcontent).

Date:

Fixed bug #66721 (__wakeup of DateTime segfaults when invalid object data is supplied).

Embed:

Fixed bug #65715 (php5embed.lib isn't provided anymore).

Fileinfo:

Fixed bug #66987 (Memory corruption in fileinfo ext / bigendian).

FPM:

Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf).

Fixed bug #67060 (possible privilege escalation due to insecure default configuration). (CVE-2014-0185)).

Json:

Fixed bug #66021 (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).

LDAP:

Fixed issue with null bytes in LDAP bindings.

15
mysqli:

Fixed problem in mysqli_commit()/mysqli_rollback() with second parameter (extra comma) and third parameters (lack
of escaping).

Openssl:

Fixed bug #66942 (memory leak in openssl_seal()).

Fixed bug #66952 (memory leak in openssl_open()).

SimpleXML:

Fixed bug #66084 (simplexml_load_string() mangles empty node name).

SQLite:

Fixed bug #66967 (Updated bundled libsqlite to 3.8.4.3)

XSL:

Fixed bug #53965 (<xsl:include> cannot find files with relative paths when loaded with "file://")

Apache2 Handler SAPI:

Fixed Apache log issue caused by APR's lack of support for %zu (APR issue
https://issues.apache.org/bugzilla/show_bug.cgi?id=56120)

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score: 5.6
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CVE CVE-2014-0185
CWE CWE-16
Affected item Web Server
Affected parameter

Content Security Policy (CSP) not implemented

16
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks,
including Cross Site Scripting (XSS) and data injection attacks.

Content Security Policy (CSP) can be implemented by adding a Content-Security-Policy header. The value of this header
is a string containing the policy directives describing your Content Security Policy. To implement CSP, you should define
lists of allowed origins for the all of the types of resources that your site utilizes. For example, if you have a simple site that
needs to load scripts, stylesheets, and images hosted locally, as well as from the jQuery library from their CDN, the CSP
header could look like the following:

Content-Security-Policy:

default-src 'self';

script-src 'self' https://code.jquery.com;

It was detected that your web application doesn't implement Content Security Policy (CSP) as the CSP header is missing
from the response. It's recommended to implement Content Security Policy (CSP) into your web application.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: Required
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

Insecure Referrer Policy

Referrer Policy controls behaviour of the Referer header, which indicates the origin or web page URL the request was
made from. The web application uses insecure Referrer Policy configuration that may leak user's information to third-party
sites.

17
 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

No HTTP Redirection

It was detected that your web application uses HTTP protocol, but doesn't automatically redirect users to HTTPS.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: Required
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None

18
 Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

(A7)Cross Site Scripting (XSS)

XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping,
or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS
allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface web sites, or redirect the
user to malicious sites.

No alerts in this category.

(A8)Insecure Deserialization

Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code
execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks.

No alerts in this category.

(A9)Using Components with Known Vulnerabilities

Components, such as libraries, frameworks, and other software modules, almost always run with full privileges. If a
vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using
components with known vulnerabilities may undermine application defenses and enable a range of possible attacks and
impacts.

Total number of alerts in this category: 4

Alerts in this category

Apache JServ protocol service

19
The Apache JServ Protocol (AJP) is a binary protocol that can proxy inbound requests from a web server through to an
application server that sits behind the web server. It's not recommended to have AJP services publicly accessible on the
internet. If AJP is misconfigured it could allow an attacker to access to internal resources.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

Directory listings (verified)

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website
directory. It is dangerous to leave this function turned on for the web server because it leads to information disclosure.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 5.3
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None

20
 Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-538
Affected item Web Server
Affected parameter

Multiple vulnerabilities fixed in PHP versions 5.5.12 and 5.4.28

List of vulnerabilities that were fixed in PHP versions 5.5.12 and 5.4.28:

Core:

Fixed bug #61019 (Out of memory on command stream_get_contents).

Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
Fixed bug #66182 (exit in stream filter produces segfault).
Fixed bug #66736 (fpassthru broken).
Fixed bug #67024 (getimagesize should recognize BMP files with negative height).
Fixed bug #67043 (substr_compare broke by previous change).

cURL:

Fixed bug #66562 (curl_exec returns differently than curl_multi_getcontent).

Date:

Fixed bug #66721 (__wakeup of DateTime segfaults when invalid object data is supplied).

Embed:

Fixed bug #65715 (php5embed.lib isn't provided anymore).

Fileinfo:

Fixed bug #66987 (Memory corruption in fileinfo ext / bigendian).

FPM:

Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf).

Fixed bug #67060 (possible privilege escalation due to insecure default configuration). (CVE-2014-0185)).

Json:

Fixed bug #66021 (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).

LDAP:

Fixed issue with null bytes in LDAP bindings.

21
mysqli:

Fixed problem in mysqli_commit()/mysqli_rollback() with second parameter (extra comma) and third parameters (lack
of escaping).

Openssl:

Fixed bug #66942 (memory leak in openssl_seal()).

Fixed bug #66952 (memory leak in openssl_open()).

SimpleXML:

Fixed bug #66084 (simplexml_load_string() mangles empty node name).

SQLite:

Fixed bug #66967 (Updated bundled libsqlite to 3.8.4.3)

XSL:

Fixed bug #53965 (<xsl:include> cannot find files with relative paths when loaded with "file://")

Apache2 Handler SAPI:

Fixed Apache log issue caused by APR's lack of support for %zu (APR issue
https://issues.apache.org/bugzilla/show_bug.cgi?id=56120)

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score: 5.6
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CVE CVE-2014-0185
CWE CWE-16
Affected item Web Server
Affected parameter

Content Security Policy (CSP) not implemented

22
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks,
including Cross Site Scripting (XSS) and data injection attacks.

Content Security Policy (CSP) can be implemented by adding a Content-Security-Policy header. The value of this header
is a string containing the policy directives describing your Content Security Policy. To implement CSP, you should define
lists of allowed origins for the all of the types of resources that your site utilizes. For example, if you have a simple site that
needs to load scripts, stylesheets, and images hosted locally, as well as from the jQuery library from their CDN, the CSP
header could look like the following:

Content-Security-Policy:

default-src 'self';

script-src 'self' https://code.jquery.com;

It was detected that your web application doesn't implement Content Security Policy (CSP) as the CSP header is missing
from the response. It's recommended to implement Content Security Policy (CSP) into your web application.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: Required
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Affected item Web Server
Affected parameter

(A10)Insufficient Logging and Monitoring

Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers
to further attack systesm, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach
studies show time to detect a breach is over 200 days, typically detected by external parties rathre than inernal processes
or monitoring.

23
No alerts in this category.

24
Affected Items: A Detailed Report

This section provides full details of the types of vulnerabilities found according to individual affected items.

/mi/login/login1.do

SQL injection

SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a
web application's database server.

This alert belongs to the following categories: A1

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Base Score: 10.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
Base Score: 6.8
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: Partial
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-89
Parameter clave
Variants 1␀À§À¢%2527%2522

SQL injection

SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a
web application's database server.

This alert belongs to the following categories: A1

25
 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Base Score: 10.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
Base Score: 6.8
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: Partial
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-89
Parameter id_usuario
Variants 1␀À§À¢%2527%2522

Web Server

Apache JServ protocol service

The Apache JServ Protocol (AJP) is a binary protocol that can proxy inbound requests from a web server through to an
application server that sits behind the web server. It's not recommended to have AJP services publicly accessible on the
internet. If AJP is misconfigured it could allow an attacker to access to internal resources.

This alert belongs to the following categories: A3, A6, A9

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None

26
 Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Parameter
Variants

Application error messages

This alert requires manual confirmation

Acunetix found one or more error/warning messages. Application error or warning messages may expose sensitive
information about an application's internal workings to an attacker.
These messages may also contain the location of the file that produced an unhandled exception.
Consult the 'Attack details' section for more information about the affected page(s).

This alert belongs to the following categories: A3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 5.3
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None
Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-200

27
 Parameter
Variants

Directory listings (verified)

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website
directory. It is dangerous to leave this function turned on for the web server because it leads to information disclosure.

This alert belongs to the following categories: A3, A6, A9

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 5.3
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None
Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-538
Parameter
Variants

Multiple vulnerabilities fixed in PHP versions 5.5.12 and 5.4.28

List of vulnerabilities that were fixed in PHP versions 5.5.12 and 5.4.28:

Core:

Fixed bug #61019 (Out of memory on command stream_get_contents).

Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
Fixed bug #66182 (exit in stream filter produces segfault).
Fixed bug #66736 (fpassthru broken).
Fixed bug #67024 (getimagesize should recognize BMP files with negative height).
Fixed bug #67043 (substr_compare broke by previous change).

cURL:

Fixed bug #66562 (curl_exec returns differently than curl_multi_getcontent).

28
Date:

Fixed bug #66721 (__wakeup of DateTime segfaults when invalid object data is supplied).

Embed:

Fixed bug #65715 (php5embed.lib isn't provided anymore).

Fileinfo:

Fixed bug #66987 (Memory corruption in fileinfo ext / bigendian).

FPM:

Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf).

Fixed bug #67060 (possible privilege escalation due to insecure default configuration). (CVE-2014-0185)).

Json:

Fixed bug #66021 (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).

LDAP:

Fixed issue with null bytes in LDAP bindings.

mysqli:

Fixed problem in mysqli_commit()/mysqli_rollback() with second parameter (extra comma) and third parameters (lack
of escaping).

Openssl:

Fixed bug #66942 (memory leak in openssl_seal()).

Fixed bug #66952 (memory leak in openssl_open()).

SimpleXML:

Fixed bug #66084 (simplexml_load_string() mangles empty node name).

SQLite:

Fixed bug #66967 (Updated bundled libsqlite to 3.8.4.3)

XSL:

Fixed bug #53965 (<xsl:include> cannot find files with relative paths when loaded with "file://")

Apache2 Handler SAPI:

Fixed Apache log issue caused by APR's lack of support for %zu (APR issue
https://issues.apache.org/bugzilla/show_bug.cgi?id=56120)

This alert belongs to the following categories: A3, A6, A9

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score: 5.6
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low

29
 Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CVE CVE-2014-0185
CWE CWE-16
Parameter
Variants

Source code disclosures

One or more pages disclosing source code were found. This check is using pattern matching to determine if server side
tags are found in the file. In some cases this alert may generate false positives.

This alert belongs to the following categories: A3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
Base Score: 5.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-538
Parameter
Variants

30
Clickjacking: X-Frame-Options header missing

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user
into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential
information or taking control of their computer while clicking on seemingly innocuous web pages.

The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking
attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed
to render a page inside a frame or iframe. Sites can use this to avoid clickjacking attacks, by ensuring that their content is
not embedded into other sites.

This alert belongs to the following categories: A3, A5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score: 5.8
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: Low
Availability Impact: None
Base Score: 4.3
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: None
Integrity Impact: Partial
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-693
Parameter
Variants

Unencrypted connection (verified)

This scan target was connected to over an unencrypted connection. A potential attacker can intercept and modify data sent
and received from this site.

This alert belongs to the following categories: A2

31
 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score: 9.1
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
Base Score: 5.8
Access Vector: Network_accessible
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-310
Parameter
Variants

Content Security Policy (CSP) not implemented

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks,
including Cross Site Scripting (XSS) and data injection attacks.

Content Security Policy (CSP) can be implemented by adding a Content-Security-Policy header. The value of this header
is a string containing the policy directives describing your Content Security Policy. To implement CSP, you should define
lists of allowed origins for the all of the types of resources that your site utilizes. For example, if you have a simple site that
needs to load scripts, stylesheets, and images hosted locally, as well as from the jQuery library from their CDN, the CSP
header could look like the following:

Content-Security-Policy:

default-src 'self';

script-src 'self' https://code.jquery.com;

It was detected that your web application doesn't implement Content Security Policy (CSP) as the CSP header is missing
from the response. It's recommended to implement Content Security Policy (CSP) into your web application.

This alert belongs to the following categories: A3, A6, A9

32
 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: Required
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Parameter
Variants

Insecure Referrer Policy

Referrer Policy controls behaviour of the Referer header, which indicates the origin or web page URL the request was
made from. The web application uses insecure Referrer Policy configuration that may leak user's information to third-party
sites.

This alert belongs to the following categories: A6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None

33
 Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Parameter
Variants

No HTTP Redirection

It was detected that your web application uses HTTP protocol, but doesn't automatically redirect users to HTTPS.

This alert belongs to the following categories: A6

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N
Base Score: 0.0
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: Required
Scope: Changed
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-16
Parameter
Variants

34
Password type input with auto-complete enabled

When a new name and password is entered in a form and the form is submitted, the browser asks if the password should
be saved.Thereafter when the form is displayed, the name and password are filled in automatically or are completed as the
name is entered. An attacker with local access could obtain the cleartext password from the browser cache.

This alert belongs to the following categories: A3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
CVSS3
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
Base Score: 0.0
Access Vector: Network_accessible
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: None
CVSS2 Exploitability: Not_defined
Remediation Level: Not_defined
Report Confidence: Not_defined
Availability Requirement: Not_defined
Collateral Damage Potential: Not_defined
Confidentiality Requirement: Not_defined
Integrity Requirement: Not_defined
Target Distribution: Not_defined
CWE CWE-200
Parameter
Variants

35
Scanned items (coverage report)
http://sisacademico.umsa.edu.bo/
http://sisacademico.umsa.edu.bo/dat/
http://sisacademico.umsa.edu.bo/dat/bkp2-main_module.php
http://sisacademico.umsa.edu.bo/dat/circ_list_prest.php
http://sisacademico.umsa.edu.bo/dat/ddesmultar_usuario.php
http://sisacademico.umsa.edu.bo/dat/main_module.php
http://sisacademico.umsa.edu.bo/dat/user_admin_edit.php
http://sisacademico.umsa.edu.bo/dat/user_lector_edit.php
http://sisacademico.umsa.edu.bo/dat/user_lector_edit_1417796514283.php
http://sisacademico.umsa.edu.bo/dat/user_lector_edit_select.php
http://sisacademico.umsa.edu.bo/dat/user_lector_new.php
http://sisacademico.umsa.edu.bo/icons/
http://sisacademico.umsa.edu.bo/mi/
http://sisacademico.umsa.edu.bo/mi/imagenes/
http://sisacademico.umsa.edu.bo/mi/imagenes/principal/
http://sisacademico.umsa.edu.bo/mi/images/
http://sisacademico.umsa.edu.bo/mi/images/infobox/
http://sisacademico.umsa.edu.bo/mi/images/pagina/
http://sisacademico.umsa.edu.bo/mi/images/pagina/b3/
http://sisacademico.umsa.edu.bo/mi/login/
http://sisacademico.umsa.edu.bo/mi/login/login.do
http://sisacademico.umsa.edu.bo/mi/login/login1.do
http://sisacademico.umsa.edu.bo/mi/login/login2.do
http://sisacademico.umsa.edu.bo/mi/style_css_900.css
http://sisacademico.umsa.edu.bo/mi/validar.js
http://sisacademico.umsa.edu.bo/mi/verBarra.do
http://sisacademico.umsa.edu.bo/mi/verCabeza.do
http://sisacademico.umsa.edu.bo/mi/verCuerpo.do
http://sisacademico.umsa.edu.bo/mi/verPie.do

36