Privacy violation
Description
The system violates one or more privacy requirements.
Impact
Incur in legal trouble due to a violation of user privacy.
Recommendation
Abide by the privacy regulations in force.
Threat
Unauthenticated attacker from the Internet in the application.
Expected Remediation Time
⌚ 300 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: L
- User interaction: N
- Scope: U
- Confidentiality: N
- Integrity: N
- Availability: L
Temporal
- Exploit code maturity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:X
- Score:
- Base: 4.3
- Temporal: 4.3
- Severity:
- Base: Medium
- Temporal: Medium
Score 4.0
Default score using CVSS 4.0 . It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): N
- Integrity (VI): N
- Availability (VA): L
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X
Result 4.0
- Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
- Score:
- CVSS-BT: 5.3
- Severity:
- CVSS-BT: Medium
Requirements
- 189.Specify the purpose of data collection
- 310.Request user consent
- 311.Demonstrate user consent
- 312.Allow user consent revocation
- 313.Inform inability to identify users
- 314.Provide processing confirmation
- 315.Provide processed data information
- 316.Allow rectification requests
- 317.Allow erasure requests
- 318.Notify third parties of changes
- 343.Respect the Do Not Track header
Fixes
free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.